CVE-2006-5444 Integer overflow in n/a

High 7.5 Published 23 Oct 2006 Updated 7 Aug 2024

Remote attackers can execute arbitrary code on Asterisk PBX systems via an integer overflow in the Skinny channel driver.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2006-5444?

CVE-2006-5444 is a high-severity vulnerability in Digium Asterisk, published on 23 Oct 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.

Which versions are affected by CVE-2006-5444?

It affects 1 product.

Products include Digium Asterisk.

How do I fix CVE-2006-5444?

Upgrade to a fixed version.

Is CVE-2006-5444 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-5444 exists.

Public exploit code: 1 Exploit-DB entry.

All Digium Asterisk vulnerabilities

Sources

Also known as DEBIAN-CVE-2006-5444, DSA-1229-1, GHSA-j3p4-x4g4-jfg2.