CVE-2007-4280 - Vulnerability Details - OpenCVE

The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Asterisk	Asterisk Asterisk Appliance Developer Kit Asterisknow S800i

Configuration 1 [-]

OR	cpe:2.3:a:asterisk:asterisk::::::::
	cpe:2.3:a:asterisk:asterisk_appliance_developer_kit::::::::
	cpe:2.3:a:asterisk:asterisknow::::::::
	cpe:2.3:a:asterisk:s800i::::::::

No data.

References

Link	Providers
http://downloads.digium.com/pub/asa/ASA-2007-019.pdf
http://secunia.com/advisories/26340
http://www.securityfocus.com/bid/25228
http://www.securitytracker.com/id?1018536
http://www.vupen.com/english/advisories/2007/2808
https://exchange.xforce.ibmcloud.com/vulnerabilities/35870

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-08-09T21:00:00

Updated: 2024-08-07T14:46:39.690Z

Reserved: 2007-08-09T00:00:00

Link: CVE-2007-4280

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-08-09T21:17:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-4280

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-08-07T00:00:00", "descriptions": [{"lang": "en", "value": "The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "ADV-2007-2808", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/2808"}, {"name": "26340", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/26340"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://downloads.digium.com/pub/asa/ASA-2007-019.pdf"}, {"name": "asterisk-skinny-channel-dos(35870)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35870"}, {"name": "25228", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/25228"}, {"name": "1018536", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1018536"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-4280", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "ADV-2007-2808", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/2808"}, {"name": "26340", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/26340"}, {"name": "http://downloads.digium.com/pub/asa/ASA-2007-019.pdf", "refsource": "CONFIRM", "url": "http://downloads.digium.com/pub/asa/ASA-2007-019.pdf"}, {"name": "asterisk-skinny-channel-dos(35870)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35870"}, {"name": "25228", "refsource": "BID", "url": "http://www.securityfocus.com/bid/25228"}, {"name": "1018536", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1018536"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T14:46:39.690Z"}, "title": "CVE Program Container", "references": [{"name": "ADV-2007-2808", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/2808"}, {"name": "26340", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/26340"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://downloads.digium.com/pub/asa/ASA-2007-019.pdf"}, {"name": "asterisk-skinny-channel-dos(35870)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35870"}, {"name": "25228", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/25228"}, {"name": "1018536", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1018536"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-4280", "datePublished": "2007-08-09T21:00:00", "dateReserved": "2007-08-09T00:00:00", "dateUpdated": "2024-08-07T14:46:39.690Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:asterisk:asterisk:*:*:*:*:*:*:*:*", "matchCriteriaId": "28786BB7-9F94-4193-81FC-83B836B9B530", "versionEndIncluding": "1.4.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:*:*:*:*:*:*:*:*", "matchCriteriaId": "39776C64-0067-4EBD-A5DD-6B7FB17B7603", "versionEndIncluding": "0.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:asterisk:asterisknow:*:*:*:*:*:*:*:*", "matchCriteriaId": "C896A32E-906D-4AD0-A00B-11DC064CBA6E", "versionEndIncluding": "beta_6", "vulnerable": true}, {"criteria": "cpe:2.3:a:asterisk:s800i:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CE11A7E-2893-47E4-897B-28BBAD984858", "versionEndIncluding": "1.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population."}, {"lang": "es", "value": "El dispositivo de canal Skinny (chan_skinny) en el Asterisk Open Source anterior al 1.4.10, el AsteriskNOW anterior al beta7, el Appliance Developer Kit anterior al 0.7.0 y el Appliance s800i before 1.0.3 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda de la aplicaci\u00f3n) a trav\u00e9s del paquete CAPABILITIES_RES_MESSAGE con una capacidad de escrutinio mayor que el array capabilities_res_message de poblaci\u00f3n."}], "id": "CVE-2007-4280", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-08-09T21:17:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://downloads.digium.com/pub/asa/ASA-2007-019.pdf"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/26340"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://www.securityfocus.com/bid/25228"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1018536"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/2808"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35870"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://downloads.digium.com/pub/asa/ASA-2007-019.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/26340"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://www.securityfocus.com/bid/25228"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1018536"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/2808"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35870"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}