CVE-2007-2293: Buffer Overflow
Multiple stack-based buffer overflows in the processsdp function in chansip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3 allow remote attackers to execute arbitrary code via a long (1) T38FaxRateManagement or (2) T38FaxUdpEC SDP parameter in an SIP message, as demonstrated using SIP INVITE.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-2293?
CVE-2007-2293 is classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2007-2293?
To fix CVE-2007-2293, upgrade Asterisk to version 1.4.3 or later, where the vulnerability has been patched.
What systems are affected by CVE-2007-2293?
CVE-2007-2293 affects Asterisk versions 1.4.1, 1.4.2, and any beta versions prior to 1.4.3.
How does CVE-2007-2293 work?
CVE-2007-2293 exploits multiple stack-based buffer overflows in the process_sdp function of the SIP channel's T.38 SDP parser.
Who can exploit CVE-2007-2293?
CVE-2007-2293 can be exploited by remote attackers via specially crafted SIP messages.