CVE-2007-3763

Asterisk < 1.2.22 and 1.4.x < 1.4.8 - Denial of Service via Crafted IAX2 LAGRQ or LAGRP Frame

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-3763. PoCs published by tenkei_ev.

AI-analyzed exploit summary This Ruby script exploits CVE-2007-3763, a DoS vulnerability in Asterisk's IAX2 channel driver. It sends malformed IAX2 control packets with subtypes 0x0b or 0x0c to crash unpatched servers by triggering a null pointer dereference.

Description

The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted (1) LAGRQ or (2) LAGRP frame that contains information elements of IAX frames, which results in a NULL pointer dereference when Asterisk does not properly set an associated variable.

Exploits (1)

exploitdb WORKING POC VERIFIED

by tenkei_ev · rubydosmultiple

https://www.exploit-db.com/exploits/4249

View Code ZIP pw:eip

This Ruby script exploits CVE-2007-3763, a DoS vulnerability in Asterisk's IAX2 channel driver. It sends malformed IAX2 control packets with subtypes 0x0b or 0x0c to crash unpatched servers by triggering a null pointer dereference.

Classification

Working Poc 95%

Attack Type

Dos

Complexity

Moderate

Reliability

Reliable

Target: Asterisk (versions prior to the fix for ASA-2007-015)

No auth needed

Prerequisites: Network access to the target's IAX2 port (UDP 4569) · Unpatched Asterisk server

MITRE ATT&CK