CVE-2007-3762 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Asterisk

4 documents4 sources

Severity

9.3CRITICALNVD

EPSS

10.2%

top 6.84%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Asterisk Debian Asterisk Asterisk Appliance Developer KIT +2 more

Timeline

PublishedJul 18

Latest updateMay 1

Description

Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to execute arbitrary code by sending a long (1) voice or (2) video RTP frame.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages6 packages

▶NVDasterisk/asterisk_appliance_developer_kit0.4

▶NVDasterisk/s800i_appliance1.0, 1.0.1+1

▶NVDasterisk/asterisknowbeta_5, beta_6+1

▶debiandebian/asterisk< asterisk 1:1.4.8~dfsg-1 (bullseye)

▶Debianasterisk/asterisk< 1:1.4.8~dfsg-1

Patches

Patch: ftp.digium.com ↗Patch: ftp.digium.com ↗

🔴Vulnerability Details

GHSA

GHSA-cwmp-cc64-x5pj: Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before 1↗2022-05-01

▶

OSV

CVE-2007-3762: Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before 1↗2007-07-18

▶

📋Vendor Advisories

Debian

CVE-2007-3762: asterisk - Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk b...↗2007

▶