CVE-2007-1306: Null Pointer Dereference
Published Mar 7, 2007
·Updated
Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol (SIP) packet without a URI and SIP-version header, which results in a NULL pointer dereference.
Affected Software
18 affected components
Asterisk=1.2.0_beta1
Asterisk=1.2.0_beta2
Asterisk=1.2.6
Asterisk=1.2.7
Asterisk=1.2.8
Asterisk=1.2.9
Asterisk=1.2.10
Asterisk=1.2.11
Asterisk=1.2.12
Asterisk=1.2.12.1
Asterisk=1.2.13
Asterisk=1.2.14
Asterisk=1.2.15
Asterisk=1.2_beta1
Asterisk=1.2_beta2
Asterisk=1.4.0
Asterisk=1.4.0_beta1
Asterisk=1.4.0_beta2
Event History
Mar 7, 2007
CVE Published
12:19 AM
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-1306?
CVE-2007-1306 has been classified as a denial of service vulnerability.
2
How do I fix CVE-2007-1306?
To fix CVE-2007-1306, upgrade Asterisk to version 1.4.1 or later, or 1.2.16 or later.
3
Which versions of Asterisk are affected by CVE-2007-1306?
Asterisk versions prior to 1.4.1 and 1.2 versions prior to 1.2.16 are affected by CVE-2007-1306.
4
What type of attack does CVE-2007-1306 involve?
CVE-2007-1306 involves remote attackers sending malformed SIP packets that lead to application crashes.
5
Can CVE-2007-1306 be exploited remotely?
Yes, CVE-2007-1306 can be exploited remotely by sending specially crafted SIP packets.