CVE-2007-1306 Null dereference in n/a

High 7.8 Published 7 Mar 2007 Updated 7 Aug 2024

Remote attackers can crash Asterisk by sending malformed SIP packets, causing a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2007-1306?

CVE-2007-1306 is a high-severity vulnerability in Digium Asterisk, published on 7 Mar 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol (SIP) packet without a URI and SIP-version header, which results in a NULL pointer dereference.

Which versions are affected by CVE-2007-1306?

It affects 1 product.

Products include Digium Asterisk.

How do I fix CVE-2007-1306?

Upgrade to a fixed version.

Is CVE-2007-1306 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-1306 exists.

Public exploit code: 1 Exploit-DB entry.

All Digium Asterisk vulnerabilities

Sources

Also known as DEBIAN-CVE-2007-1306, GHSA-j5g7-pvcx-38pp.