Asterisk contains an integer overflow vulnerability. This vulnerability may allow an attacker to run arbitrary code.
Asterisk is an open-source PBX software package that provides voicemail, three-way calling, and other features. Skinny Client Control Protocol (SCCP) is a proprietary Cisco protocol that is used to connect Cisco Call Managers and Cisco Voice over IP (VOIP) phones. Asterisk provides a driver for phones that use the SCCP protocol called chan_skinny.
An integer overflow vulnerability exists in the get_input(struct skinnysession *s) function which is found in the chan_skinny driver. Exploitation of this vulnerability may allow an attacker to execute arbitrary code.
A remote, unauthenticated attacker may be able to execute arbitrary code with root privileges.
This vulnerability report was based on information from Adam Boileau of Security-Assessment.com.
This document was written by Ryan Giobbi.
|Date First Published:||2006-10-24|
|Date Last Updated:||2007-01-19 17:44 UTC|