Description
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.securitytracker.com/id?1017794 ↗
- http://marc.info/?l=full-disclosure&m=117432783011737&w=2 ↗
- http://secunia.com/advisories/24564 ↗
- http://asterisk.org/node/48339 ↗
- http://www.novell.com/linux/security/advisories/2007_34_asterisk.html ↗
- http://www.securityfocus.com/archive/1/463434/100/0/threaded ↗
- http://www.securityfocus.com/bid/23031 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33068 ↗
- http://security.gentoo.org/glsa/glsa-200704-01.xml ↗
- http://secunia.com/advisories/25582 ↗
- http://secunia.com/advisories/24719 ↗
- http://www.sineapps.com/news.php?rssid=1707 ↗
- http://www.vupen.com/english/advisories/2007/1039 ↗
- http://www.debian.org/security/2007/dsa-1358 ↗
- http://www.osvdb.org/34479 ↗
- http://voipsa.org/pipermail/voipsec_voipsa.org/2007-March/002275.html ↗