製品・ソフトウェアに関する情報

JVN脆弱性詳細

Asterisk Open Source の SIP チャネルドライバ (chan_sip) におけるサービス運用妨害 (DoS) の脆弱性

Title	Asterisk Open Source の SIP チャネルドライバ (chan_sip) におけるサービス運用妨害 (DoS) の脆弱性
Summary	Asterisk Open Source、AsteriskNOW、Asterisk Appliance Developer Kit および s800i (Asterisk Appliance) の SIP チャネルドライバ (chan_sip) には、サービス運用妨害 (メモリ消耗) 状態となる脆弱性が存在します。
Possible impacts	第三者により、SIP ダイアログを介して、大量の履歴エントリ生成を誘発し、サービス運用妨害 (メモリ消耗) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 21, 2007, midnight
Registration Date	June 26, 2012, 3:54 p.m.
Last Update	June 26, 2012, 3:54 p.m.

Affected System

Digium

Asterisk Open Source の 1.4.11 未満の 1.4.x

Asterisk Appliance Developer Kit 0.8.0 未満

AsteriskNOW beta7 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2007-4455	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4455
National Vulnerability Database (NVD)
2	CVE-2007-4455	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4455

ベンダー情報

No	Name	URL
Asterisk
1	AST-2007-020	http://downloads.asterisk.org/pub/security/AST-2007-020.html

Change Log

No	Changed Details	Date of change
0	[2012年06月26日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2007-4455

Summary	The SIP channel driver (chan_sip) in Asterisk Open Source 1.4.x before 1.4.11, AsteriskNOW before beta7, Asterisk Appliance Developer Kit 0.x before 0.8.0, and s800i (Asterisk Appliance) 1.x before 1.0.3 allows remote attackers to cause a denial of service (memory exhaustion) via a SIP dialog that causes a large number of history entries to be created.
Summary	El controlador de canal SIP (chan_sip) en Asterisk Open Source 1.4.x anterior a 1.4.11, AsteriskNOW anterior a beta7, Asterisk Appliance Developer Kit 0.x anterior a 0.8.0, y s800i (Asterisk Appliance) 1.x anterior a 1.0.3 permite a atacantes remotos provocar una denegación de servicio (agotamiento de memoria) mediante un diálogo SIP que provoca que se cree un gran número de entradas de histórico.
Publication Date	Aug. 22, 2007, 10:17 a.m.
Registration Date	Jan. 29, 2021, 2:18 p.m.
Last Update	April 23, 2026, 9:35 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:asterisk:asterisk::::::::		1.4.9
cpe:2.3:a:asterisk:asterisk_appliance_developer_kit::::::::		0.7
cpe:2.3:a:asterisk:asterisknow::::::::		beta_6

Related information, measures and tools

No	URL	refsource
1	http://downloads.digium.com/pub/asa/AST-2007-020.html	cve@mitre.org
2	http://seclists.org/fulldisclosure/2007/Aug/0393.html	cve@mitre.org
3	http://secunia.com/advisories/26553	cve@mitre.org
4	http://securityreason.com/securityalert/3047	cve@mitre.org
5	http://www.securityfocus.com/bid/25392	cve@mitre.org
6	http://www.securitytracker.com/id?1018595	cve@mitre.org
7	http://www.vupen.com/english/advisories/2007/2953	cve@mitre.org
8	https://exchange.xforce.ibmcloud.com/vulnerabilities/36145	cve@mitre.org
9	http://downloads.digium.com/pub/asa/AST-2007-020.html	af854a3a-2127-422b-91ae-364da2661108
10	http://seclists.org/fulldisclosure/2007/Aug/0393.html	af854a3a-2127-422b-91ae-364da2661108
11	http://secunia.com/advisories/26553	af854a3a-2127-422b-91ae-364da2661108
12	http://securityreason.com/securityalert/3047	af854a3a-2127-422b-91ae-364da2661108
13	http://www.securityfocus.com/bid/25392	af854a3a-2127-422b-91ae-364da2661108
14	http://www.securitytracker.com/id?1018595	af854a3a-2127-422b-91ae-364da2661108
15	http://www.vupen.com/english/advisories/2007/2953	af854a3a-2127-422b-91ae-364da2661108
16	https://exchange.xforce.ibmcloud.com/vulnerabilities/36145	af854a3a-2127-422b-91ae-364da2661108

Common Vulnerabilities List