Vulnerability Intelligence Report
CVE-2007-3763
The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted (1) LAGRQ or (2) LAGRP frame that contains information elements of IAX frames, which results in a NULL pointer dereference when Asterisk does not properly set an associated variable.
No Active Exploit Signals
CVSS Base Score
5.0
MEDIUM
EPSS Probability:26.56%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| asterisk | asterisk | 1.0, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.2.0_beta1, 1.2.0_beta2, 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.2.9, 1.2.10, 1.2.11, 1.2.12, 1.2.13, 1.2.14, 1.2.15, 1.2.16, 1.2.17, 1.4.1, 1.4.2, 1.4.4_2007-04-27, 1.4_beta, a, b.1.3.2, b.1.3.3, b.2.2.0 |
| asterisk | asterisk_appliance_developer_kit | all |
| asterisk | asterisknow | beta_5, beta_6 |
| asterisk | s800i_appliance | 1.0, 1.0.1 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
26.560%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2007-07-13T00:00:00 |
| Published | 2007-07-18T17:00:00 |
| Patch Date | 2007-07-17 |
| Last Updated | 2024-08-07T14:28:52 |
Community Chatter & Buzz