| Package | Affected versions | Patched versions |
|---|---|---|
| asterisk | ≥ 1.2.20, < 1.2.23≥ 1.4.0, < 1.4.9 | 1.2.231.4.9 |
| asterisk appliance developer kit | < 0.6.0 | 0.6.0 |
The IAX2 channel driver (chan_iax2) in Asterisk Open 1.2.x before 1.2.23, 1.4.x before 1.4.9, and Asterisk Appliance Developer Kit before 0.6.0, when configured to allow unauthenticated calls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake, which causes an ast_channel to be allocated but not released.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free