CVE-2007-1561

HIGH 7.8CVE-2007-1561 · Published 21/03/2007 · updated 16/06/2026

Package	Affected versions	Patched versions
asterisk asterisk	`= 1.2.14= 1.2.15= 1.2.16= 1.4.1`	No fix yet

Description

The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.

References

asterisk.org/node/48339
marc.info
secunia.com/advisories/24564
secunia.com/advisories/24719
secunia.com/advisories/25582
security.gentoo.org/glsa/glsa-200704-01.xml
voipsa.org/pipermail/voipsec_voipsa.org/2007-March/002275.html
debian.org/security/2007/dsa-1358
novell.com/linux/security/advisories/2007_34_asterisk.html
osvdb.org/34479
securityfocus.com/archive/1/463434/100/0/threaded
securityfocus.com/bid/23031 · Patch
securitytracker.com/id
sineapps.com/news.php
vupen.com/english/advisories/2007/1039
exchange.xforce.ibmcloud.com/vulnerabilities/33068

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free