The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted (1) LAGRQ or (2) LAGRP frame that contains information elements of IAX frames, which results in a NULL pointer dereference when Asterisk does not properly set an associated variable.

The remote host is affected by the vulnerability described in GLSA-200802-11 (Asterisk: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in Asterisk:
    Russel Bryant reported a stack-based buffer overflow in the IAX2 channel     driver (chan_iax2) when bridging calls between chan_iax2 and any     channel driver that uses RTP for media (CVE-2007-3762).
    Chris     Clark and Zane Lackey (iSEC Partners) reported a NULL pointer     dereference in the IAX2 channel driver (chan_iax2)     (CVE-2007-3763).
    Will Drewry (Google Security) reported a     vulnerability in the Skinny channel driver (chan_skinny), resulting in     an overly large memcpy (CVE-2007-3764).
    Will Drewry (Google     Security) reported a vulnerability in the IAX2 channel driver     (chan_iax2), that does not correctly handle unauthenticated     transactions using a 3-way handshake (CVE-2007-4103).
  Impact :

    By sending a long voice or video RTP frame, a remote attacker could     possibly execute arbitrary code on the target machine. Sending     specially crafted LAGRQ or LAGRP frames containing information elements     of IAX frames, or a certain data length value in a crafted packet, or     performing a flood of calls not completing a 3-way handshake, could     result in a Denial of Service.
  Workaround :

    There is no known workaround at this time.

This update fixes multiple bugs in asterisk that allowed remote attackers to crash the asterisk server or even execute arbitrary code (CVE-2007-3762, CVE-2007-3763, CVE-2007-3764).

Several remote vulnerabilities have been discovered in Asterisk, a free software PBX and telephony toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1306     'Mu Security' discovered that a NULL pointer dereference     in the SIP implementation could lead to denial of     service.

  - CVE-2007-1561     Inria Lorraine discovered that a programming error in     the SIP implementation could lead to denial of service.

  - CVE-2007-2294     It was discovered that a NULL pointer dereference in the     manager interface could lead to denial of service.

  - CVE-2007-2297     It was discovered that a programming error in the SIP     implementation could lead to denial of service.

  - CVE-2007-2488     Tim Panton and Birgit Arkestein discovered that a     programming error in the IAX2 implementation could lead     to information disclosure.

  - CVE-2007-3762     Russell Bryant discovered that a buffer overflow in the     IAX implementation could lead to the execution of     arbitrary code.

  - CVE-2007-3763     Chris Clark and Zane Lackey discovered that several NULL     pointer dereferences in the IAX2 implementation could     lead to denial of service.

  - CVE-2007-3764     Will Drewry discovered that a programming error in the     Skinny implementation could lead to denial of service.

ID	Name	Product	Family	Severity
31294	GLSA-200802-11 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
27158	openSUSE 10 Security Update : asterisk (asterisk-3977)	Nessus	SuSE Local Security Checks	high
25938	Debian DSA-1358-1 : asterisk - several vulnerabilities	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2007-3763

high

Tenable Plugins

high

high

critical