CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 0CVE-2007-1595
https://notcve.org/view.php?id=CVE-2007-1595
The Asterisk Extension Language (AEL) in pbx/pbx_ael.c in Asterisk does not properly generate extensions, which allows remote attackers to execute arbitrary extensions and have an unknown impact by specifying an invalid extension in a certain form. El Lenguaje de Extensión de Asterisk (AEL) en pbx/pbx_ael.c de Asterisk no genera extensiones apropiadamente, lo cual permite a atacantes remotos ejecutar extensiones de su elección y tener un impacto desconocido especificando una extensión inválida en formularios concretos. • http://bugs.digium.com/view.php?id=9316 http://secunia.com/advisories/24694 http://secunia.com/advisories/25582 http://svn.digium.com/view/asterisk?rev=59073&view=rev http://www.novell.com/linux/security/advisories/2007_34_asterisk.html http://www.securityfocus.com/bid/23155 http://www.vupen.com/english/advisories/2007/1123 •
CVSS: 7.8EPSS: 93%CPEs: 37EXPL: 0CVE-2007-1594
https://notcve.org/view.php?id=CVE-2007-1594
The handle_response function in chan_sip.c in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP Response code 0 in a SIP packet. La función handle_response en chan_sip.c de Asterisk before 1.2.17 y 1.4.x versiones anteriores a 1.4.2 permite a atacantes remotos provocar una denegación de servicio (caída) mediante una respuesta SIP código 0 en un paquete SIP. • http://bugs.digium.com/view.php?id=9313 http://secunia.com/advisories/24579 http://secunia.com/advisories/24719 http://secunia.com/advisories/25582 http://security.gentoo.org/glsa/glsa-200704-01.xml http://svn.digium.com/view/asterisk/trunk/channels/chan_sip.c?r1=58907&r2=59038 http://voipsa.org/pipermail/voipsec_voipsa.org/2007-March/002275.html http://www.asterisk.org/node/48338 http://www.novell.com/linux/security/advisories/2007_34_asterisk.html http://www.sec •
CVSS: 7.8EPSS: 30%CPEs: 4EXPL: 1CVE-2007-1561 – Asterisk 1.2.16/1.4.1 - SIP INVITE Remote Denial of Service
https://notcve.org/view.php?id=CVE-2007-1561
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address. El controlador del canal en Asterisk en versiones anteriores a 1.2.17 y 1.4.x en versiones anteriores a 1.4.2 permite a atacantes remotos provocar una denegación de servicio (caída) a través de un mensaje SIP INVITE con un SDP que contiene una dirección IP válida y otra no válida. • https://www.exploit-db.com/exploits/3566 http://asterisk.org/node/48339 http://marc.info/?l=full-disclosure&m=117432783011737&w=2 http://secunia.com/advisories/24564 http://secunia.com/advisories/24719 http://secunia.com/advisories/25582 http://security.gentoo.org/glsa/glsa-200704-01.xml http://voipsa.org/pipermail/voipsec_voipsa.org/2007-March/002275.html http://www.debian.org/security/2007/dsa-1358 http://www.novell.com/linux/security/advisories/2007_34_asterisk.htm •
CVSS: 7.8EPSS: 95%CPEs: 18EXPL: 1CVE-2007-1306 – Asterisk 1.2.15/1.4.0 - Remote Denial of Service
https://notcve.org/view.php?id=CVE-2007-1306
Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol (SIP) packet without a URI and SIP-version header, which results in a NULL pointer dereference. Asterisk versiones 1.4 anteriores a 1.4.1 y versiones 1.2 anteriores a 1.2.16, permite a atacantes remotos causar una denegación de servicio (bloqueo) enviando un paquete de Session Initiation Protocol (SIP) sin una URI y Encabezado SIP-version, lo que resulta en una desreferencia del puntero NULL. • https://www.exploit-db.com/exploits/3407 http://asterisk.org/node/48319 http://asterisk.org/node/48320 http://labs.musecurity.com/advisories/MU-200703-01.txt http://secunia.com/advisories/24380 http://secunia.com/advisories/24578 http://secunia.com/advisories/25582 http://security.gentoo.org/glsa/glsa-200703-14.xml http://www.debian.org/security/2007/dsa-1358 http://www.kb.cert.org/vuls/id/228032 http://www.novell.com/linux/security/advisories/2007_34_asterisk •
CVSS: 7.8EPSS: 84%CPEs: 13EXPL: 0CVE-2006-5445
https://notcve.org/view.php?id=CVE-2006-5445
Unspecified vulnerability in the SIP channel driver (channels/chan_sip.c) in Asterisk 1.2.x before 1.2.13 and 1.4.x before 1.4.0-beta3 allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors that result in the creation of "a real pvt structure" that uses more resources than necessary. Vulnerabilidad no especificada en el controlador de canal SIP (channels/chan_sip.c) en ASterisk 1.2.x anteriores a 1.2.13 y 1.4.x aneriores a 1.4.0-beta3 permite a atacantes remotos provocar una denegación de servicio (agotamiento de recursos) a través de vectores no especificados que resultan en la creación de una "estructura pvt real" que usa más recursos de los necesarios. • http://ftp.digium.com/pub/asterisk/releases/ChangeLog-1.2.13 http://secunia.com/advisories/22651 http://secunia.com/advisories/22979 http://www.asterisk.org/node/109 http://www.asterisk.org/node/110 http://www.gentoo.org/security/en/glsa/glsa-200610-15.xml http://www.novell.com/linux/security/advisories/2006_69_asterisk.html http://www.osvdb.org/29973 http://www.securityfocus.com/archive/1/449183/100/0/threaded http://www.securityfocus.com/bid/20835 http: •