Overview
Asterisk contains a null pointer dereference vulnerability that may allow a remote, unauthenticated attacker to cause a denial-of-service condition on a vulnerable system.
Description
Asterisk is a popular PBX application with VoIP support. Asterisk contains a null pointer dereference vulnerability that can allow a remote, unauthenticated attacker to crash the Asterisk server software with a specially crafted Session Initiation Protocol (SIP) packet (typically udp/5060). |
Impact
A remote, unauthenticated attacker may be able to cause a denial of service on a vulnerable server. |
Solution
Apply an update This issue is addressed in Asterisk versions 1.4.1 and 1.2.16. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This vulnerability was reported by the Mu Security research team.
This document was written by Will Dormann.
Other Information
| CVE IDs: | CVE-2007-1306 |
| Severity Metric: | 7.85 |
| Date Public: | 2007-03-04 |
| Date First Published: | 2007-03-05 |
| Date Last Updated: | 2007-03-19 19:15 UTC |
| Document Revision: | 13 |