CVE-2007-4280 - The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before be

CVE-2007-4280

Summary

The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population.

References

Vulnerable Configurations

cpe:2.3:a:asterisk:asterisk:*:*:*:*:*:*:*:*
cpe:2.3:a:asterisk:asterisk:*:*:*:*:*:*:*:*
cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:*:*:*:*:*:*:*:*
cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:*:*:*:*:*:*:*:*
cpe:2.3:a:asterisk:asterisknow:*:*:*:*:*:*:*:*
cpe:2.3:a:asterisk:asterisknow:*:*:*:*:*:*:*:*
cpe:2.3:a:asterisk:s800i:*:*:*:*:*:*:*:*
cpe:2.3:a:asterisk:s800i:*:*:*:*:*:*:*:*

CVSS

Base:	3.5 (as of 29-07-2017 - 01:32)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	SINGLE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:S/C:N/I:N/A:P

refmap via4

bid	25228
confirm	http://downloads.digium.com/pub/asa/ASA-2007-019.pdf
sectrack	1018536
secunia	26340
vupen	ADV-2007-2808
xf	asterisk-skinny-channel-dos(35870)

Last major update

29-07-2017 - 01:32

Published

09-08-2007 - 21:17

Last modified

29-07-2017 - 01:32