The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via truncated IAX 2 (IAX2) video frames, which bypasses a length check and leads to a buffer overflow involving negative length check. NOTE: the vendor advisory claims that only a DoS is possible, but the original researcher is reliable.

A security problem was fixed in the IAX2 channel driver of Asterisk that could be used by remote users to execute code or at least crash Asterisk. This issue is tracked by the Mitre CVE ID CVE-2006-2898.

A problem has been discovered in the IAX2 channel driver of Asterisk, an Open Source Private Branch Exchange and telephony toolkit, which may allow a remote attacker to cause a crash of the Asterisk server.

The remote host is affected by the vulnerability described in GLSA-200606-15 (Asterisk: IAX2 video frame buffer overflow)

    Asterisk fails to properly check the length of truncated video frames     in the IAX2 channel driver which results in a buffer overflow.
  Impact :

    An attacker could exploit this vulnerability by sending a specially     crafted IAX2 video stream resulting in the execution of arbitrary code     with the permissions of the user running Asterisk.
  Workaround :

    Disable public IAX2 support.

ID	Name	Product	Family	Severity
27155	openSUSE 10 Security Update : asterisk (asterisk-1676)	Nessus	SuSE Local Security Checks	high
22668	Debian DSA-1126-1 : asterisk - buffer overflow	Nessus	Debian Local Security Checks	high
21708	GLSA-200606-15 : Asterisk: IAX2 video frame buffer overflow	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2006-2898

critical

Tenable Plugins

high

high

high