CVE-2007-3762

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-07-18 · updated 2026-06-16

Description

Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to execute arbitrary code by sending a long (1) voice or (2) video RTP frame.

Affected products

Asterisk: 1.0, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10 (+25)
Asterisk Appliance Developer Kit: through 0.4
Asterisknow: beta_5, beta_6
asterisk S800I Appliance: 1.0, 1.0.1

References

http://bugs.gentoo.org/show_bug.cgi?id=185713
http://ftp.digium.com/pub/asa/ASA-2007-014.pdf
http://secunia.com/advisories/26099
http://secunia.com/advisories/29051
http://security.gentoo.org/glsa/glsa-200802-11.xml
http://www.debian.org/security/2007/dsa-1358
http://www.novell.com/linux/security/advisories/2007_15_sr.html
http://www.securityfocus.com/bid/24949
http://www.securitytracker.com/id?1018407
http://www.vupen.com/english/advisories/2007/2563
https://exchange.xforce.ibmcloud.com/vulnerabilities/35466
http://bugs.gentoo.org/show_bug.cgi?id=185713

Get alerted when CVE-2007-3762 or the next vulnerability affects your stack