CVE-2007-4103
High
Description
The IAX2 channel driver (chan_iax2) in Asterisk Open 1.2.x before 1.2.23, 1.4.x before 1.4.9, and Asterisk Appliance Developer Kit before 0.6.0, when configured to allow unauthenticated calls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake, which causes an ast_channel to be allocated but not released.
SeverityHigh
CVSS7.5
Exploit probability—
ProductDigium Asterisk
PublishedJul 31, 2007
First seenJul 31, 2007
How to fix
Update
- digium asterisk1.2.23, 1.4.9 or later
- digium asterisk_appliance_developer_kit0.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| digium asterisk | 1.2.20 ≤ v < 1.2.23, 1.4.0 ≤ v < 1.4.9 | 1.2.23, 1.4.9 |
| digium asterisk_appliance_developer_kit | v < 0.6.0 | 0.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.