CVE-2006-2898
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
7.9 High
AI Score
Confidence
Low
0.149 Low
EPSS
Percentile
95.8%
The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via truncated IAX 2 (IAX2) video frames, which bypasses a length check and leads to a buffer overflow involving negative length check. NOTE: the vendor advisory claims that only a DoS is possible, but the original researcher is reliable.
Affected configurations
References
secunia.com/advisories/20497
secunia.com/advisories/20658
secunia.com/advisories/20899
secunia.com/advisories/21222
securitytracker.com/id?1016236
www.asterisk.org/node/95
www.debian.org/security/2006/dsa-1126
www.gentoo.org/security/en/glsa/glsa-200606-15.xml
www.novell.com/linux/security/advisories/2006_38_security.html
www.securityfocus.com/archive/1/436127/100/0/threaded
www.securityfocus.com/archive/1/436671/100/0/threaded
www.securityfocus.com/bid/18295
www.vupen.com/english/advisories/2006/2181
exchange.xforce.ibmcloud.com/vulnerabilities/27045
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
7.9 High
AI Score
Confidence
Low
0.149 Low
EPSS
Percentile
95.8%