CVE-2007-4103
First published: Tue Jul 31 2007(Updated: )
The IAX2 channel driver (chan_iax2) in Asterisk Open 1.2.x before 1.2.23, 1.4.x before 1.4.9, and Asterisk Appliance Developer Kit before 0.6.0, when configured to allow unauthenticated calls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake, which causes an ast_channel to be allocated but not released.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Digium Asterisk | =1.4.5 | |
| Digium Asterisknow Pre-release | =beta6 | |
| Digium Asterisk | =1.2.21 | |
| Digium Asterisk | =1.2.20 | |
| Digium Asterisk | =1.2.22 | |
| Digium Asterisk Appliance Developer Kit | =0.5.0 | |
| Digium Asterisk | =1.4.7 | |
| Digium Asterisk | =1.4.7.1 | |
| Digium Asterisk | =1.2.21.1 | |
| Digium Asterisk | =1.4.8 | |
| Digium Asterisk | >=1.2.20<1.2.23 | |
| Digium Asterisk | >=1.4.0<1.4.9 | |
| Digium Asterisk Appliance Developer Kit | <0.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://ftp.digium.com/pub/asa/ASA-2007-018.pdf
- http://www.securitytracker.com/id?1018472
- http://secunia.com/advisories/26274
- http://www.securityfocus.com/bid/24950
- http://securityreason.com/securityalert/2960
- http://bugs.gentoo.org/show_bug.cgi?id=185713
- http://security.gentoo.org/glsa/glsa-200802-11.xml
- http://secunia.com/advisories/29051
- http://osvdb.org/38197
- http://www.vupen.com/english/advisories/2007/2701
- http://www.securityfocus.com/archive/1/475069/100/0/threaded
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/severity
- agent/references
- agent/last-modified-date
- agent/author
- agent/remedy
- agent/weakness
- agent/tags
- agent/softwarecombine
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/digium
- canonical/digium asterisk
- version/digium asterisk/1.4.5
- canonical/digium asterisknow pre-release
- version/digium asterisknow pre-release/beta6
- version/digium asterisk/1.2.21
- version/digium asterisk/1.2.20
- version/digium asterisk/1.2.22
- canonical/digium asterisk appliance developer kit
- version/digium asterisk appliance developer kit/0.5.0
- version/digium asterisk/1.4.7
- version/digium asterisk/1.4.7.1
- version/digium asterisk/1.2.21.1
- version/digium asterisk/1.4.8
- version/digium asterisk/1.4.0