CVE-2007-2294 — Asterisk vulnerability

4 documents4 sources
Severity
7.8HIGHNVD
EPSS
4.6%
top 10.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
AsteriskDebian Asterisk
Timeline
PublishedApr 26
Latest updateMay 1

Description

The Manager Interface in Asterisk before 1.2.18 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (crash) by using MD5 authentication to authenticate a user that does not have a password defined in manager.conf, resulting in a NULL pointer dereference.

CVSS vector

AV:N/AC:L/C:N/I:N/A:CExploitability: 10.0 | Impact: 6.9

Affected Packages3 packages

▶debiandebian/asterisk< asterisk 1:1.4.3~dfsg-1 (bullseye)
▶Debianasterisk/asterisk< 1:1.4.3~dfsg-1
▶NVDasterisk/asterisk18 versions+17

Patches

Patch: secunia.com ↗Patch: secunia.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-769c-mjpc-3rqq: The Manager Interface in Asterisk before 1↗2022-05-01
▶
OSV
CVE-2007-2294: The Manager Interface in Asterisk before 1↗2007-04-26
▶

📋Vendor Advisories

1
Debian
CVE-2007-2294: asterisk - The Manager Interface in Asterisk before 1.2.18 and 1.4.x before 1.4.3 allows re...↗2007
▶