Debian Security Advisory DSA 1358-1 (asterisk)

The remote host is missing an update to asterisk announced via advisory DSA 1358-1. OpenVAS Vulnerability Test $Id: deb13581.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1358-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian: Security Advisory (DSA-1358-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 8 Update: asterisk-1.4.17-1.fc8

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...

[SECURITY] Fedora 7 Update: asterisk-1.4.17-1.fc7

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...

Command injection

registry.pl in Fonality Trixbox 2.0 PBX products, when running in certain environments, reads and executes a set of commands from a remote web site without sufficiently validating the origin of the commands, which allows remote attackers to disable trixbox and execute arbitrary commands via a DNS...

CVE-2007-6424

CVE-2007-6424 affects Fonality Trixbox 2.0 PBX; the registry.pl script reads commands from a remote site without proper origin validation, enabling a DNS spoofing vector that lets remote attackers disable Trixbox and execute arbitrary commands. Affected component: registry.pl; root cause: insuffi...

CVE-2007-6424

registry.pl in Fonality Trixbox 2.0 PBX products, when running in certain environments, reads and executes a set of commands from a remote web site without sufficiently validating the origin of the commands, which allows remote attackers to disable trixbox and execute arbitrary commands via a DNS...

DSA-1417-1 asterisk - SQL injection

Bulletin has no description...

openSUSE 10 Security Update : asterisk (asterisk-2272)

This update fixes 2 security problem in the PBX software Asterisk. CVE-2006-5444: Integer overflow in the getinput function in the Skinny channel driver chanskinny.c as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integ...

Asterisk多个远程拒绝服务漏洞

BUGTRAQ ID: 24950 CVECAN ID: CVE-2007-3763,CVE-2007-3764,CVE-2007-3765 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 Asterisk...

asteridex-exec.txt

Hoku Security Vulnerability Advisory Title: AsteriDex remote command execution Vendor URL: http://bestof.nerdvittles.com/applications/asteridex/ Type: Command injection / remote code execution Vulnerable versions: = 3.0 Risk factor: High Popularity: Low Author: Carl Livitt Contact: [email protected]...

Asterisk SIP T.38 SDP解析远程栈溢出漏洞

Asterisk是一款PBX系统的软件，运行在Linux系统上，支持使用SIP、IAX、H323协议进行IP通话。 Asterisk的SIP/SDP处理器中存在多个远程栈溢出漏洞，远程攻击者可能利用此漏洞控制服务器。 如果所发送SIP报文中的SDP数据包含有超长的T38参数的话，就可以触发这个溢出，导致执行任意代码。这个漏洞是由chansip.c文件中的processsdp函数调用sscanf所导致的： else if sscanfa, "T38FaxRateManagement:%s", s == 1 found = 1; if optiondebug 2 astlogLOGDEBUG...

Asterisk SIP响应远程拒绝服务漏洞

Asterisk是一款PBX系统的软件，运行在Linux系统上，支持使用SIP、IAX、H323协议进行IP通话。 Asterisk在处理远程系统的SIP回复时存在拒绝服务漏洞，如果远程系统所发送的SIP回复中包含有SIP Response code 0的话，就会导致服务崩溃。 Asterisk Asterisk 1.4.x 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://ftp.digium.com/pub/asterisk/releases/asterisk-1.4.2.tar.gz...

Asterisk PBX SIP DoS

Application crash on malcrafted SIP packet...

[Full-disclosure] Asterisk SDP DOS vulnerability

MADYNES Security Advisory http://madynes.loria.fr/ http://madynes.loria.fr Title: Asterisk SIP INVITE remote DOS Release Date: 08/03/2007 Severity: High - Denial of Service Advisory ID:KIPH1 Software: Asterisk http://www.asterisk.org/ http://www.asterisk.org/ AsteriskR is a complete IP PBX in...

SUSE-SA:2006:069: asterisk

The remote host is missing the patch for the advisory SUSE-SA:2006:069 asterisk. Two security problem have been found and fixed in the PBX software Asterisk. CVE-2006-5444: Integer overflow in the getinput function in the Skinny channel driver chanskinny.c as used by Cisco SCCP phones, allows...

Asterisk存在多个安全漏洞

Asterisk是一款开放源代码的PBX系统。 Asterisk MGCP实现存在远程堆栈缓冲区溢出，远程攻击者可以利用漏洞以进程权限执行任意指令。 攻击者可以通过使用畸形AUEP audit endpoint应答消息来触发。 另一个问题是存在于处理发送给Record函数的文件名，通过格式串攻击可导致任意代码执行，或者通过目录遍历攻击可导致任意文件覆盖。不过这个漏洞需要管理员使用客户端控制的变量作为文件名的一部分。 Asterisk Asterisk 1.2.10 Asterisk Asterisk 1.2.9 Asterisk Asterisk 1.2.8 Asterisk...

[Full-disclosure] Asterisk Local and Remote Denial of Service Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Product: Asterisk Open Source PBX Impact: Multiple Local and Remote Denials of Service Versions: All versions prior to 1.2.13 Author: Jesus Oquendo echo @infiltrated|sed 's/^/sil/g;s/$/.net/g' I. BACKGROUND Asterisk is an Open Source PBX which runs on...

Asterisk chan_skinny远程缓冲区溢出漏洞

Asterisk是一款PBX系统的软件，运行在Linux系统上，支持使用SIP、IAX、H323协议进行IP通话。 Asterisk的chanskinny.c文件中的static int getinputstruct skinnysession s函数没有正确地验证报文头中用户所提供的长度。远程攻击者可以通过发送特制报文来触发缓冲区溢出漏洞，导致执行任意指令。 asterisk-1.2.12.1/channels/chanskinny.c的2860-2870中的漏洞代码： ---------------- res = reads-fd, s-inbuf, 4; // - integer...

Skinny Server Detection

The remote server is an H.323 proxy that understands the Skinny protocol, also known as SCCP, for 'Skinny Client Control Protocol'. Skinny is Cisco's proprietary lightweight terminal control protocol used by some VoIP phones to communicate with Cisco CallManager or Asterisk PBX systems. C Tenable...