CVE-2007-3765

NameCVE-2007-3765
DescriptionThe STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs433681

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
asterisk (PTS)bullseye1:16.28.0~dfsg-0+deb11u4fixed
bullseye (security)1:16.28.0~dfsg-0+deb11u6fixed
sid1:22.3.0~dfsg+~cs6.15.60671435-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
asterisksourcesarge(not affected)
asterisksourceetch(not affected)
asterisksource(unstable)1:1.4.8~dfsg-1433681

Notes

[sarge] - asterisk <not-affected> (1.0.x not affected)
[etch] - asterisk <not-affected> (1.2.x not affected)
https://downloads.avaya.com/elmodocs2/security/ASA-2007-017.htm
Search for package or bug name: Reporting problems