CVE-2007-4103: High severity Digium Asterisk vulnerability
The IAX2 channel driver (chaniax2) in Asterisk Open 1.2.x before 1.2.23, 1.4.x before 1.4.9, and Asterisk Appliance Developer Kit before 0.6.0, when configured to allow unauthenticated calls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake, which causes an astchannel to be allocated but not released.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-4103?
CVE-2007-4103 has a severity rating that indicates it can lead to a denial of service due to resource exhaustion.
How do I fix CVE-2007-4103?
To fix CVE-2007-4103, apply the appropriate patches or upgrade to a non-vulnerable version of Asterisk.
Which versions are affected by CVE-2007-4103?
CVE-2007-4103 affects Asterisk versions prior to 1.2.23 and 1.4.9, as well as versions of the Asterisk Appliance Developer Kit before 0.6.0.
What type of attack does CVE-2007-4103 allow?
CVE-2007-4103 allows remote attackers to flood the server with unauthenticated calls, causing a denial of service.
Is CVE-2007-4103 specific to a certain configuration in Asterisk?
Yes, CVE-2007-4103 specifically affects configurations of Asterisk that permit unauthenticated calls.