Published: 26/04/2007 Updated: 16/10/2018

CVSS v2 Base Score: 7.6 | Impact Score: 10 | Exploitability Score: 4.9

VMScore: 770

Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C

Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the SIP channel T.38 SDP parser in Asterisk prior to 1.4.3 allow remote malicious users to execute arbitrary code via a long (1) T38FaxRateManagement or (2) T38FaxUdpEC SDP parameter in an SIP message, as demonstrated using SIP INVITE.

Vulnerable Product	Search on Vulmon	Subscribe to Product
asterisk asterisk 1.4.1
asterisk asterisk 1.4.2
asterisk asterisk 1.4_beta

source: wwwsecurityfocuscom/bid/23648/info Asterisk is prone to multiple remote stack-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data before copying it to insufficiently sized buffers Successful exploits may allow an attacker to execute arbitrary machine code to compromi ...

source: wwwsecurityfocuscom/bid/23648/info Asterisk is prone to multiple remote stack-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data before copying it to insufficiently sized buffers Successful exploits may allow an attacker to execute arbitrary machine code to compromise ...

NVD-CWE-Other http://www.asterisk.org/files/ASA-2007-010.pdf http://www.securityfocus.com/bid/23648 http://www.securitytracker.com/id?1017951 http://secunia.com/advisories/24977 http://www.osvdb.org/35368 http://www.securitytracker.com/id?1018337 http://securityreason.com/securityalert/2645 http://www.vupen.com/english/advisories/2007/1534 https://exchange.xforce.ibmcloud.com/vulnerabilities/33895 http://www.securityfocus.com/archive/1/472804/100/0/threaded http://www.securityfocus.com/archive/1/466883/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/29901/

CVE-2007-2293

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect