PT-2007-5471 · Digium · Asterisknow+3

Published 2007-08-09 · Updated 2017-07-29 · CVE-2007-4280

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions prior to 1.4.10 AsteriskNOW versions prior to beta7 Appliance Developer Kit versions prior to 0.7.0 Appliance s800i versions prior to 1.0.3

Description The issue allows remote authenticated users to cause a denial of service, resulting in an application crash. This is achieved by sending a CAPABILITIES RES MESSAGE packet with a capabilities count larger than the capabilities res message array population.

Recommendations For Asterisk Open Source versions prior to 1.4.10, update to version 1.4.10 or later. For AsteriskNOW versions prior to beta7, update to beta7 or later. For Appliance Developer Kit versions prior to 0.7.0, update to version 0.7.0 or later. For Appliance s800i versions prior to 1.0.3, update to version 1.0.3 or later.

Fix

Related Identifiers

CVE-2007-4280

Affected Products

Appliance Developer Kit

Appliance S800I

Asterisk Open Source

Asterisknow

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2007-4280 · Security Note
• http://securityfocus.com/bid/25228 · Patch
• https://security-tracker.debian.org/tracker/CVE-2007-4280 · Vendor Advisory
• http://secunia.com/advisories/26340 · Vendor Advisory
• http://downloads.digium.com/pub/asa/ASA-2007-019.pdf · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-4280 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-4280 · Vendor Advisory
• http://securitytracker.com/id?1018536 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35870 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4280 · Note
• http://vupen.com/english/advisories/2007/2808 · Note