CVE-2007-3765
ASA-2007-017.txt
Severity Score
7.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.
La implementación STUN en Asterisk 1.4.x anterior a 1.4.8, AsteriskNOW anterior a beta7, Appliance Developer Kit anterior a 0.5.0, y s800i anterior a 1.0.2 permite a atacantes remotos provocar denegación de servicio (caida) a través de una longitud de atributo manipulado STUN en un paquete STUN enviado a un puerto RTP.
The Asterisk STUN implementation in the RTP stack has a remotely exploitable crash vulnerability. A pointer may run past accessible memory if Asterisk receives a specially crafted STUN packet on an active RTP port. The code that parses the incoming STUN packets incorrectly checks that the length indicated in the STUN attribute and the size of the STUN attribute header does not exceed the available data. This will cause the data pointer to run past accessible memory and when accessed will cause a crash.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2007-07-13 CVE Reserved
- 2007-07-18 CVE Published
- 2024-08-07 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://secunia.com/advisories/26099 | Third Party Advisory | |
| http://www.securityfocus.com/bid/24950 | Vdb Entry | |
| http://www.securitytracker.com/id?1018407 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2007/2563 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/35480 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://ftp.digium.com/pub/asa/ASA-2007-017.pdf | 2017-07-29 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.0 Search vendor "Asterisk" for product "Asterisk" and version "1.0" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.0.6 Search vendor "Asterisk" for product "Asterisk" and version "1.0.6" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.0.7 Search vendor "Asterisk" for product "Asterisk" and version "1.0.7" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.0.8 Search vendor "Asterisk" for product "Asterisk" and version "1.0.8" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.0.9 Search vendor "Asterisk" for product "Asterisk" and version "1.0.9" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.0.10 Search vendor "Asterisk" for product "Asterisk" and version "1.0.10" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.0.11 Search vendor "Asterisk" for product "Asterisk" and version "1.0.11" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.0.12 Search vendor "Asterisk" for product "Asterisk" and version "1.0.12" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.2.0_beta1 Search vendor "Asterisk" for product "Asterisk" and version "1.2.0_beta1" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.2.0_beta2 Search vendor "Asterisk" for product "Asterisk" and version "1.2.0_beta2" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.2.5 Search vendor "Asterisk" for product "Asterisk" and version "1.2.5" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.2.6 Search vendor "Asterisk" for product "Asterisk" and version "1.2.6" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.2.7 Search vendor "Asterisk" for product "Asterisk" and version "1.2.7" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.2.8 Search vendor "Asterisk" for product "Asterisk" and version "1.2.8" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.2.9 Search vendor "Asterisk" for product "Asterisk" and version "1.2.9" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.2.10 Search vendor "Asterisk" for product "Asterisk" and version "1.2.10" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.2.11 Search vendor "Asterisk" for product "Asterisk" and version "1.2.11" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.2.12 Search vendor "Asterisk" for product "Asterisk" and version "1.2.12" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.2.13 Search vendor "Asterisk" for product "Asterisk" and version "1.2.13" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.2.14 Search vendor "Asterisk" for product "Asterisk" and version "1.2.14" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.2.15 Search vendor "Asterisk" for product "Asterisk" and version "1.2.15" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.2.16 Search vendor "Asterisk" for product "Asterisk" and version "1.2.16" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.2.17 Search vendor "Asterisk" for product "Asterisk" and version "1.2.17" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.4.1 Search vendor "Asterisk" for product "Asterisk" and version "1.4.1" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.4.2 Search vendor "Asterisk" for product "Asterisk" and version "1.4.2" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.4.4_2007-04-27 Search vendor "Asterisk" for product "Asterisk" and version "1.4.4_2007-04-27" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | 1.4_beta Search vendor "Asterisk" for product "Asterisk" and version "1.4_beta" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | a Search vendor "Asterisk" for product "Asterisk" and version "a" | business |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | b.1.3.2 Search vendor "Asterisk" for product "Asterisk" and version "b.1.3.2" | business |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | b.1.3.3 Search vendor "Asterisk" for product "Asterisk" and version "b.1.3.3" | business |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Search vendor "Asterisk" for product "Asterisk" | b.2.2.0 Search vendor "Asterisk" for product "Asterisk" and version "b.2.2.0" | business |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisk Appliance Developer Kit Search vendor "Asterisk" for product "Asterisk Appliance Developer Kit" | <= 0.4 Search vendor "Asterisk" for product "Asterisk Appliance Developer Kit" and version " <= 0.4" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisknow Search vendor "Asterisk" for product "Asterisknow" | beta_5 Search vendor "Asterisk" for product "Asterisknow" and version "beta_5" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Asterisknow Search vendor "Asterisk" for product "Asterisknow" | beta_6 Search vendor "Asterisk" for product "Asterisknow" and version "beta_6" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | S800i Appliance Search vendor "Asterisk" for product "S800i Appliance" | 1.0 Search vendor "Asterisk" for product "S800i Appliance" and version "1.0" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | S800i Appliance Search vendor "Asterisk" for product "S800i Appliance" | 1.0.1 Search vendor "Asterisk" for product "S800i Appliance" and version "1.0.1" | - |
Affected
| ||||||