PT-2007-5305 · Digium · Asterisk Appliance Developer Kit+1

Published 2007-07-31 · Updated 2024-02-08 · CVE-2007-4103

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Asterisk Open versions 1.2.x through 1.2.22 Asterisk Open versions 1.4.x through 1.4.8 Asterisk Appliance Developer Kit versions prior to 0.6.0

Description The issue allows remote attackers to cause a denial of service, resulting in resource exhaustion. This occurs when the IAX2 channel driver is configured to allow unauthenticated calls and is flooded with calls that do not complete a 3-way handshake, causing an ast channel to be allocated but not released.

Recommendations For Asterisk Open versions 1.2.x through 1.2.22, update to version 1.2.23 or later. For Asterisk Open versions 1.4.x through 1.4.8, update to version 1.4.9 or later. For Asterisk Appliance Developer Kit versions prior to 0.6.0, update to version 0.6.0 or later.

Fix

DoS

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2007-4103

Affected Products

Asterisk Appliance Developer Kit

Asterisk Open

References · 16

• https://security-tracker.debian.org/tracker/CVE-2007-4103 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-4103 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200802-11.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4103 · Security Note
• http://bugs.gentoo.org/show_bug.cgi?id=185713 · Patch
• http://secunia.com/advisories/26274 · Vendor Advisory
• http://ftp.digium.com/pub/asa/ASA-2007-018.pdf · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-4103 · Vendor Advisory
• http://securitytracker.com/id?1018472 · Note
• http://secunia.com/advisories/29051 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4103 · Note
• http://vupen.com/english/advisories/2007/2701 · Note
• http://securityfocus.com/archive/1/475069/100/0/threaded · Note
• http://securityreason.com/securityalert/2960 · Note
• http://securityfocus.com/bid/24950 · Note