Vulnerability Details : CVE-2007-1561

The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.
Publish Date : 2007-03-21 Last Update Date : 2017-07-28

Collapse All Expand All Select Select&Copy	Scroll To Vendor Statements(0) Additional Vendor Data(0) OVAL Definitions(0) Vulnerable Products(0) # Of Vulns By Products References(0) Metasploit Modules(0)	Comments View User Comments Add Comment	External Links Secunia Advisories XForce Advisories Vulnerability Details at NVD Vulnerability Details at Mitre Nessus Plugins Linux Kernel Git Repository First CVSS Guide
Search Twitter Search YouTube Search Google

- CVSS Scores & Vulnerability Types

CVSS Score	7.8
Confidentiality Impact	None (There is no impact to the confidentiality of the system.)
Integrity Impact	None (There is no impact to the integrity of the system)
Availability Impact	Complete (There is a total shutdown of the affected resource. The attacker can render the resource completely unavailable.)
Access Complexity	Low (Specialized access conditions or extenuating circumstances do not exist. Very little knowledge or skill is required to exploit. )
Authentication	Not required (Authentication is not required to exploit the vulnerability.)
Gained Access	None
Vulnerability Type(s)	Denial Of Service
CWE ID	CWE id is not defined for this vulnerability

- Related OVAL Definitions

Title	Definition Id	Class	Family
DSA-1358-1 asterisk	oval:org.mitre.oval:def:18250		unix

OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify a vulnerability or a missing patch. Check out the OVAL definitions if you want to learn what you should do to verify a vulnerability.

- Products Affected By CVE-2007-1561

#	Product Type	Vendor	Product	Version
1	Application	Asterisk	Asterisk	1.2.14	Version Details Vulnerabilities
2	Application	Asterisk	Asterisk	1.2.15	Version Details Vulnerabilities
3	Application	Asterisk	Asterisk	1.2.16	Version Details Vulnerabilities
4	Application	Asterisk	Asterisk	1.4.1	Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor	Product	Vulnerable Versions
Asterisk	Asterisk	4

- References For CVE-2007-1561

https://exchange.xforce.ibmcloud.com/vulnerabilities/33068
XF asterisk-sip-invite-dos(33068)

http://www.vupen.com/english/advisories/2007/1039
VUPEN ADV-2007-1039

http://www.sineapps.com/news.php?rssid=1707 CONFIRM

http://security.gentoo.org/glsa/glsa-200704-01.xml
GENTOO GLSA-200704-01

http://voipsa.org/pipermail/voipsec_voipsa.org/2007-March/002275.html
MLIST [VOIPSEC] 20070319 Asterisk SDP DOS vulnerability

http://www.debian.org/security/2007/dsa-1358
DEBIAN DSA-1358

http://www.novell.com/linux/security/advisories/2007_34_asterisk.html
SUSE SUSE-SA:2007:034

http://www.securityfocus.com/archive/1/archive/1/463434/100/0/threaded
BUGTRAQ 20070321 Two new DoS Vulnerabilities in Asterisk Fixed

http://www.securitytracker.com/id?1017794
SECTRACK 1017794

http://www.securityfocus.com/bid/23031
BID 23031 Asterisk SIP Invite Message Remote Denial of Service Vulnerability Release Date:2007-08-28

http://asterisk.org/node/48339 CONFIRM

http://marc.info/?l=full-disclosure&m=117432783011737&w=2
FULLDISC 20070319 Asterisk SDP DOS vulnerability

- Metasploit Modules Related To CVE-2007-1561

There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)