CVE-2006-2898: Buffer Overflow
The IAX2 channel driver (chaniax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via truncated IAX 2 (IAX2) video frames, which bypasses a length check and leads to a buffer overflow involving negative length check. NOTE: the vendor advisory claims that only a DoS is possible, but the original researcher is reliable.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2898?
CVE-2006-2898 is considered to have a high severity due to its potential to cause denial of service and execute arbitrary code.
How do I fix CVE-2006-2898?
To fix CVE-2006-2898, upgrade Asterisk to version 1.2.9 or later for the 1.2.x series, or 1.0.11 or later for the 1.0.x series.
What versions of Asterisk are affected by CVE-2006-2898?
CVE-2006-2898 affects Asterisk versions 1.0.7 through 1.0.10 and 1.2.0 beta releases up to 1.2.8.
What type of vulnerability is CVE-2006-2898?
CVE-2006-2898 is a buffer overflow vulnerability that leads to denial of service and arbitrary code execution.
Who can exploit CVE-2006-2898?
Remote attackers can exploit CVE-2006-2898 by sending specially crafted IAX2 video frames to the affected Asterisk systems.