medium5.0Public exploit code

CVE-2007-3763

The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Deve…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Asterisk < 1.2.22/1.4.8 - IAX2 Channel Driver Remote Crash2007-07-31 · dos · multiple · Verified

Impact

The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted (1) LAGRQ or (2) LAGRP frame that contains information elements of IAX frames, which results in a NULL pointer dereference when Asterisk does not properly set an associated variable.

Affected products

Vendor	Product	Affected versions
Asterisk	Asterisk	Versions 1.0, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10
Asterisk	Asterisk Appliance Developer Kit	through 0.4
Asterisk	Asterisknow	Versions beta_5, beta_6
Asterisk	S800i Appliance	Versions 1.0, 1.0.1

Public exploit code

Impact

Affected products

References