CVE-2007-4103 Denial of service in n/a

High 7.5 Published 31 Jul 2007 Updated 7 Aug 2024

Remote attackers can cause resource exhaustion and denial of service in Asterisk by flooding unauthenticated IAX2 calls that fail to complete handshakes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2007-4103?

CVE-2007-4103 is a high-severity denial of service vulnerability in Digium Asterisk, published on 31 Jul 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The IAX2 channel driver (chan_iax2) in Asterisk Open 1.2.x before 1.2.23, 1.4.x before 1.4.9, and Asterisk Appliance Developer Kit before 0.6.0, when configured to allow unauthenticated calls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake, which causes an ast_channel to be allocated but not released.

Weakness: CWE-772

Which versions are affected by CVE-2007-4103?

It affects 2 products.

Products include Digium Asterisk, Digium Asterisk Appliance Developer Kit.

How do I fix CVE-2007-4103?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2007-4103 being exploited?

There is no known exploitation of CVE-2007-4103 in the wild and no public exploit code.

All Digium Asterisk vulnerabilities

Sources

Also known as DEBIAN-CVE-2007-4103, GHSA-9jqm-gvwx-9wxq.