CVE-2007-2297 Affecting asterisk package, versions <1:1.4.2~dfsg-1


Severity

Recommended
medium

Based on Debian security rating.

Threat Intelligence

EPSS
16.27% (97th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-ASTERISK-428891
  • published26 Apr 2007
  • disclosed26 Apr 2007

Introduced: 26 Apr 2007

CVE-2007-2297  (opens in a new tab)

How to fix?

Upgrade Debian:unstable asterisk to version 1:1.4.2~dfsg-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream asterisk package and not the asterisk package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

The SIP channel driver (chan_sip) in Asterisk before 1.2.18 and 1.4.x before 1.4.3 does not properly parse SIP UDP packets that do not contain a valid response code, which allows remote attackers to cause a denial of service (crash).

CVSS Scores

version 3.1