Published: 23/10/2006 Updated: 17/10/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x prior to 1.0.12 and 1.2.x prior to 1.2.13, as used by Cisco SCCP phones, allows remote malicious users to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.

Vulnerable Product	Search on Vulmon	Subscribe to Product
digium asterisk 0.4
digium asterisk 0.7
digium asterisk 1.0.8
digium asterisk 1.0.9
digium asterisk 1.2.9
digium asterisk 1.2_beta1
digium asterisk 0.2
digium asterisk 0.3
digium asterisk 1.0.11
digium asterisk 1.0.7
digium asterisk 1.2.7
digium asterisk 1.2.8
digium asterisk 0.1.7
digium asterisk 0.1.8
digium asterisk 0.7.1
digium asterisk 0.7.2
digium asterisk 1.2.10
digium asterisk 1.2.11
digium asterisk 1.2_beta2
digium asterisk 0.1.9
digium asterisk 0.1.9.1
digium asterisk 0.9
digium asterisk 1.0
digium asterisk 1.0.10
digium asterisk 1.2.12
digium asterisk 1.2.6

Adam Boileau discovered an integer overflow in the Skinny channel driver in Asterisk, an Open Source Private Branch Exchange or telephone system, as used by Cisco SCCP phones, which allows remote attackers to execute arbitrary code For the stable distribution (sarge) this problem has been fixed in version 107dfsg1-2sarge4 For the unstable dis ...

Debian Bug report logs - #394025 CVE-2006-5444: Remote compromise in chan_skinny Package: asterisk; Maintainer for asterisk is Debian VoIP Team <pkg-voip-maintainers@listsaliothdebianorg>; Source for asterisk is src:asterisk (PTS, buildd, popcon) Reported by: Metlstorm <metlstorm@stormnetnz> Date: Wed, 18 Oct 20 ...

Debian Bug report logs - #395080 CVE-2006-5445: Denial of service in chan_sip Package: asterisk; Maintainer for asterisk is Debian VoIP Team <pkg-voip-maintainers@listsaliothdebianorg>; Source for asterisk is src:asterisk (PTS, buildd, popcon) Reported by: Stefan Fritsch <sf@sfritschde> Date: Tue, 24 Oct 2006 20: ...

Debian Bug report logs - #338116 asterisk-web-vmail: Information disclosure of voice mail messages through vmailcgi Package: asterisk-web-vmail; Maintainer for asterisk-web-vmail is (unknown); Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Tue, 8 Nov 2005 09:33:14 UTC Severity: important Tags: patch, security Fo ...

#!/usr/bin/perl # Beyond Security # Copyright Noam Rathaus <noamr@beyondsecuritycom> # # The following proof of concept causes the chan_skippy to crash in different locations and due to # memory corruption as well as double free calls, this is based on the finding of # Security-Assessmentcom, and proves that the vulnerability is indeed exp ...

NVD-CWE-Other http://ftp.digium.com/pub/asterisk/releases/ChangeLog-1.0.12 http://ftp.digium.com/pub/asterisk/releases/ChangeLog-1.2.13 http://www.asterisk.org/node/109 http://www.securityfocus.com/bid/20617 http://securitytracker.com/id?1017089 http://secunia.com/advisories/22480 http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050171.html http://www.kb.cert.org/vuls/id/521252 http://www.gentoo.org/security/en/glsa/glsa-200610-15.xml http://www.osvdb.org/29972 http://secunia.com/advisories/22651 http://www.novell.com/linux/security/advisories/2006_69_asterisk.html http://secunia.com/advisories/22979 http://www.us.debian.org/security/2006/dsa-1229 http://secunia.com/advisories/23212 http://www.vupen.com/english/advisories/2006/4097 https://exchange.xforce.ibmcloud.com/vulnerabilities/29663 http://www.securityfocus.com/archive/1/449183/100/0/threaded http://www.securityfocus.com/archive/1/449127/100/0/threaded https://nvd.nist.gov https://www.debian.org/security/./dsa-1229 https://www.exploit-db.com/exploits/2597/https://www.kb.cert.org/vuls/id/521252

CVE-2006-5444

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect