CVE-2007-3765 (CNNVD-200707-345)
MEDIUM
中文标题:
Asterisk RTP栈拒绝服务攻击漏洞
英文标题:
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Develope...
CVSS分数:
5.0
发布时间:
2007-07-18 17:00:00
漏洞类型:
其他
状态:
PUBLISHED
数据质量分数:
0.30
数据版本:
v3
漏洞描述
中文描述:
Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 Asterisk在RTP栈的STUN实现中存在拒绝服务漏洞。如果Asterisk在活动的RTP端口上接收到了特制的STUN报文的话，指针就可能超过可访问的内存。负责解析入站STUN报文的代码无法确认表示STUN属性的长度和STUN属性头大小是否超过了可用的数据，因此数据指针可能超过可访问的内存，导致崩溃。成功攻击要求启用了chan_sip、chan_gtalk、chan_jingle、chan_h323、chan_mgcp或chan_skinny。
英文描述:
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.
CWE类型:
（暂无数据）
标签:
（暂无数据）
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| asterisk | asterisk | 1.0 | - | - |
cpe:2.3:a:asterisk:asterisk:1.0:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.0.6 | - | - |
cpe:2.3:a:asterisk:asterisk:1.0.6:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.0.7 | - | - |
cpe:2.3:a:asterisk:asterisk:1.0.7:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.0.8 | - | - |
cpe:2.3:a:asterisk:asterisk:1.0.8:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.0.9 | - | - |
cpe:2.3:a:asterisk:asterisk:1.0.9:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.0.10 | - | - |
cpe:2.3:a:asterisk:asterisk:1.0.10:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.0.11 | - | - |
cpe:2.3:a:asterisk:asterisk:1.0.11:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.0.12 | - | - |
cpe:2.3:a:asterisk:asterisk:1.0.12:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.2.0_beta1 | - | - |
cpe:2.3:a:asterisk:asterisk:1.2.0_beta1:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.2.0_beta2 | - | - |
cpe:2.3:a:asterisk:asterisk:1.2.0_beta2:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.2.5 | - | - |
cpe:2.3:a:asterisk:asterisk:1.2.5:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.2.6 | - | - |
cpe:2.3:a:asterisk:asterisk:1.2.6:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.2.7 | - | - |
cpe:2.3:a:asterisk:asterisk:1.2.7:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.2.8 | - | - |
cpe:2.3:a:asterisk:asterisk:1.2.8:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.2.9 | - | - |
cpe:2.3:a:asterisk:asterisk:1.2.9:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.2.10 | - | - |
cpe:2.3:a:asterisk:asterisk:1.2.10:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.2.11 | - | - |
cpe:2.3:a:asterisk:asterisk:1.2.11:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.2.12 | - | - |
cpe:2.3:a:asterisk:asterisk:1.2.12:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.2.13 | - | - |
cpe:2.3:a:asterisk:asterisk:1.2.13:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.2.14 | - | - |
cpe:2.3:a:asterisk:asterisk:1.2.14:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.2.15 | - | - |
cpe:2.3:a:asterisk:asterisk:1.2.15:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.2.16 | - | - |
cpe:2.3:a:asterisk:asterisk:1.2.16:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.2.17 | - | - |
cpe:2.3:a:asterisk:asterisk:1.2.17:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.4.1 | - | - |
cpe:2.3:a:asterisk:asterisk:1.4.1:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.4.2 | - | - |
cpe:2.3:a:asterisk:asterisk:1.4.2:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.4.4_2007-04-27 | - | - |
cpe:2.3:a:asterisk:asterisk:1.4.4_2007-04-27:*:*:*:*:*:*:*
|
| asterisk | asterisk | 1.4_beta | - | - |
cpe:2.3:a:asterisk:asterisk:1.4_beta:*:*:*:*:*:*:*
|
| asterisk | asterisk | a | - | - |
cpe:2.3:a:asterisk:asterisk:a:*:business:*:*:*:*:*
|
| asterisk | asterisk | b.1.3.2 | - | - |
cpe:2.3:a:asterisk:asterisk:b.1.3.2:*:business:*:*:*:*:*
|
| asterisk | asterisk | b.1.3.3 | - | - |
cpe:2.3:a:asterisk:asterisk:b.1.3.3:*:business:*:*:*:*:*
|
| asterisk | asterisk | b.2.2.0 | - | - |
cpe:2.3:a:asterisk:asterisk:b.2.2.0:*:business:*:*:*:*:*
|
| asterisk | asterisk_appliance_developer_kit | * | - | - |
cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:*:*:*:*:*:*:*:*
|
| asterisk | asterisknow | beta_5 | - | - |
cpe:2.3:a:asterisk:asterisknow:beta_5:*:*:*:*:*:*:*
|
| asterisk | asterisknow | beta_6 | - | - |
cpe:2.3:a:asterisk:asterisknow:beta_6:*:*:*:*:*:*:*
|
| asterisk | s800i_appliance | 1.0 | - | - |
cpe:2.3:h:asterisk:s800i_appliance:1.0:*:*:*:*:*:*:*
|
| asterisk | s800i_appliance | 1.0.1 | - | - |
cpe:2.3:h:asterisk:s800i_appliance:1.0.1:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
CVSS评分详情
5.0
MEDIUM
CVSS向量:
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS版本:
2.0
机密性
NONE
完整性
NONE
可用性
PARTIAL
时间信息
发布时间:
2007-07-18 17:00:00
修改时间:
2024-08-07 14:28:52
创建时间:
2025-11-11 15:32:45
更新时间:
2025-11-11 15:49:19
利用信息
暂无可利用代码信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2007-3765 |
2025-11-11 15:17:54 | 2025-11-11 07:32:45 |
| NVD | nvd_CVE-2007-3765 |
2025-11-11 14:52:11 | 2025-11-11 07:41:31 |
| CNNVD | cnnvd_CNNVD-200707-345 |
2025-11-11 15:08:57 | 2025-11-11 07:49:19 |
版本与语言
当前版本:
v3
主要语言:
EN
支持语言:
EN
ZH
安全公告
暂无安全公告信息
变更历史
v3
CNNVD
2025-11-11 15:49:19
vulnerability_type: 未提取 → 其他; cnnvd_id: 未提取 → CNNVD-200707-345; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-200707-345
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2
NVD
2025-11-11 15:41:31
cvss_score: 未提取 → 5.0; cvss_vector: NOT_EXTRACTED → AV:N/AC:L/Au:N/C:N/I:N/A:P; cvss_version: NOT_EXTRACTED → 2.0; affected_products_count: 0 → 36; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
- cvss_score: 未提取 -> 5.0
- cvss_vector: NOT_EXTRACTED -> AV:N/AC:L/Au:N/C:N/I:N/A:P
- cvss_version: NOT_EXTRACTED -> 2.0
- affected_products_count: 0 -> 36
- data_sources: ['cve'] -> ['cve', 'nvd']