CVE-2006-2898
published 2006-06-07CVE-2006-2898: The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and…
PriorityP335high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
4.21%
89.7th percentile
The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via truncated IAX 2 (IAX2) video frames, which bypasses a length check and leads to a buffer overflow involving negative length check. NOTE: the vendor advisory claims that only a DoS is possible, but the original researcher is reliable.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | asterisk | < asterisk 1:1.2.10.dfsg-2 (bullseye) | asterisk 1:1.2.10.dfsg-2 (bullseye) |
| debian | iaxmodem | < asterisk 1:1.2.10.dfsg-2 (bullseye) | asterisk 1:1.2.10.dfsg-2 (bullseye) |
| digium | asterisk | — | — |
| digium | asterisk | — | — |
| digium | asterisk | — | — |
| digium | asterisk | — | — |
| digium | asterisk | — | — |
| digium | asterisk | — | — |
| digium | asterisk | — | — |
| digium | asterisk | — | — |
| digium | asterisk | — | — |
| digium | asterisk | >= 0 < 1:1.2.10.dfsg-2 | 1:1.2.10.dfsg-2 |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4f9c-vvfw-m8rr: The IAX2 channel driver (chan_iax2) for Asterisk 1
ghsa_unreviewed·2022-05-01
CVE-2006-2898 [HIGH] CWE-119 GHSA-4f9c-vvfw-m8rr: The IAX2 channel driver (chan_iax2) for Asterisk 1
The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via truncated IAX 2 (IAX2) video frames, which bypasses a length check and leads to a buffer overflow involving negative length check. NOTE: the vendor advisory claims that only a DoS is possible, but the original researcher is reliable.
OSV
CVE-2006-2898: The IAX2 channel driver (chan_iax2) for Asterisk 1
osv·2006-06-07·CVSS 7.5
CVE-2006-2898 [HIGH] CVE-2006-2898: The IAX2 channel driver (chan_iax2) for Asterisk 1
The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via truncated IAX 2 (IAX2) video frames, which bypasses a length check and leads to a buffer overflow involving negative length check. NOTE: the vendor advisory claims that only a DoS is possible, but the original researcher is reliable.
Debian
CVE-2006-2898: asterisk - The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x be...
vendor_debian·2006·CVSS 7.5
CVE-2006-2898 [HIGH] CVE-2006-2898: asterisk - The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x be...
The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via truncated IAX 2 (IAX2) video frames, which bypasses a length check and leads to a buffer overflow involving negative length check. NOTE: the vendor advisory claims that only a DoS is possible, but the original researcher is reliable.
Scope: local
bullseye: resolved (fixed in 1:1.2.10.dfsg-2)
sid: resolved (fixed in 1:1.2.10.dfsg-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://secunia.com/advisories/20497http://secunia.com/advisories/20658http://secunia.com/advisories/20899http://secunia.com/advisories/21222http://securitytracker.com/id?1016236http://www.asterisk.org/node/95http://www.debian.org/security/2006/dsa-1126http://www.gentoo.org/security/en/glsa/glsa-200606-15.xmlhttp://www.novell.com/linux/security/advisories/2006_38_security.htmlhttp://www.securityfocus.com/archive/1/436127/100/0/threadedhttp://www.securityfocus.com/archive/1/436671/100/0/threadedhttp://www.securityfocus.com/bid/18295http://www.vupen.com/english/advisories/2006/2181https://exchange.xforce.ibmcloud.com/vulnerabilities/27045http://secunia.com/advisories/20497http://secunia.com/advisories/20658http://secunia.com/advisories/20899http://secunia.com/advisories/21222http://securitytracker.com/id?1016236http://www.asterisk.org/node/95http://www.debian.org/security/2006/dsa-1126http://www.gentoo.org/security/en/glsa/glsa-200606-15.xmlhttp://www.novell.com/linux/security/advisories/2006_38_security.htmlhttp://www.securityfocus.com/archive/1/436127/100/0/threadedhttp://www.securityfocus.com/archive/1/436671/100/0/threadedhttp://www.securityfocus.com/bid/18295http://www.vupen.com/english/advisories/2006/2181https://exchange.xforce.ibmcloud.com/vulnerabilities/27045
2006-06-07
Published