CVE-2007-2488
Severity Score
10.0
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The IAX2 channel driver (chan_iax2) in Asterisk before 20070504 does not properly null terminate data, which allows remote attackers to trigger loss of transmitted data, and possibly obtain sensitive information (memory contents) or cause a denial of service (application crash), by sending a frame that lacks a 0 byte.
El controlador del canal IAX2 (chan_iax2) en Asterisk anterior a 20070504 no anula correctamente los datos terminales, lo cual permite a atacantes remotos disparar la pérdida de datos transmitidos, y posiblemente obtener información sensible (contenido de memoria) o provocar denegación de servicio (caida de aplicación), enviando un marco que carece 0 bytes.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2007-05-03 CVE Reserved
- 2007-05-07 CVE Published
- 2024-07-02 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| http://ftp.digium.com/pub/asa/ASA-2007-013.pdf | X_refsource_confirm | |
| http://osvdb.org/35769 | Vdb Entry | |
| http://secunia.com/advisories/25134 | Third Party Advisory | |
| http://secunia.com/advisories/25582 | Third Party Advisory | |
| http://www.securityfocus.com/bid/23824 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2007/1661 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/34085 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.debian.org/security/2007/dsa-1358 | 2017-07-29 | |
| http://www.novell.com/linux/security/advisories/2007_34_asterisk.html | 2017-07-29 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | <= 1.4.4_2007-04-27 Search vendor "Asterisk" for product "Asterisk" and version " <= 1.4.4_2007-04-27" | - |
Affected
| ||||||