CVSS: 5.0EPSS: 95%CPEs: 5EXPL: 2CVE-2008-0095 – Asterisk 1.x - BYE Message Remote Denial of Service
https://notcve.org/view.php?id=CVE-2008-0095
The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit before Asterisk 1.4 revision 95946, and Appliance s800i 1.0.x before 1.0.3.4 allows remote attackers to cause a denial of service (daemon crash) via a BYE message with an Also (Also transfer) header, which triggers a NULL pointer dereference. El controlador de canal SIP de Asterisk Open Source 1.4.x versiones anteriores a 1.4.17, Business Edition versiones anteriores a C.1.0-beta8, AsteriskNOW versiones anteriores a beta7, Appliance Developer Kit versiones anteriores a Asterisk 1.4 revision 95946, y Appliance s800i 1.0.x versiones anteriores a 1.0.3.4 permite a atacantes remotos provocar una denegación de servicio (cáida de demonio) mediante un mensaje BYE con una cabecera Also (tranfiere también), que dispara un referencia a puntero NULL. • https://www.exploit-db.com/exploits/30974 http://bugs.digium.com/view.php?id=11637 http://downloads.digium.com/pub/security/AST-2008-001.html http://secunia.com/advisories/28299 http://secunia.com/advisories/28312 http://securityreason.com/securityalert/3520 http://www.securityfocus.com/archive/1/485727/100/0/threaded http://www.securityfocus.com/bid/27110 http://www.securitytracker.com/id?1019152 http://www.vupen.com/english/advisories/2008/0019 https://exchange.xforce • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 11%CPEs: 3EXPL: 0CVE-2007-4455
https://notcve.org/view.php?id=CVE-2007-4455
The SIP channel driver (chan_sip) in Asterisk Open Source 1.4.x before 1.4.11, AsteriskNOW before beta7, Asterisk Appliance Developer Kit 0.x before 0.8.0, and s800i (Asterisk Appliance) 1.x before 1.0.3 allows remote attackers to cause a denial of service (memory exhaustion) via a SIP dialog that causes a large number of history entries to be created. El controlador de canal SIP (chan_sip) en Asterisk Open Source 1.4.x anterior a 1.4.11, AsteriskNOW anterior a beta7, Asterisk Appliance Developer Kit 0.x anterior a 0.8.0, y s800i (Asterisk Appliance) 1.x anterior a 1.0.3 permite a atacantes remotos provocar una denegación de servicio (agotamiento de memoria) mediante un diálogo SIP que provoca que se cree un gran número de entradas de histórico. • http://downloads.digium.com/pub/asa/AST-2007-020.html http://seclists.org/fulldisclosure/2007/Aug/0393.html http://secunia.com/advisories/26553 http://securityreason.com/securityalert/3047 http://www.securityfocus.com/bid/25392 http://www.securitytracker.com/id?1018595 http://www.vupen.com/english/advisories/2007/2953 https://exchange.xforce.ibmcloud.com/vulnerabilities/36145 •
CVSS: 3.5EPSS: 93%CPEs: 4EXPL: 0CVE-2007-4280
https://notcve.org/view.php?id=CVE-2007-4280
The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population. El dispositivo de canal Skinny (chan_skinny) en el Asterisk Open Source anterior al 1.4.10, el AsteriskNOW anterior al beta7, el Appliance Developer Kit anterior al 0.7.0 y el Appliance s800i before 1.0.3 permite a atacantes remotos provocar una denegación de servicio (caída de la aplicación) a través del paquete CAPABILITIES_RES_MESSAGE con una capacidad de escrutinio mayor que el array capabilities_res_message de población. • http://downloads.digium.com/pub/asa/ASA-2007-019.pdf http://secunia.com/advisories/26340 http://www.securityfocus.com/bid/25228 http://www.securitytracker.com/id?1018536 http://www.vupen.com/english/advisories/2007/2808 https://exchange.xforce.ibmcloud.com/vulnerabilities/35870 •