asterisk: multiple vulnerabilities
| Package(s): | asterisk | CVE #(s): | CVE-2007-6430 CVE-2008-1332 CVE-2008-1333 | ||||||||||||||||||||
| Created: | March 20, 2008 | Updated: | April 25, 2008 | ||||||||||||||||||||
| Description: | From the Debian alert:
CVE-2007-6430: Tilghman Lesher discovered that database-based registrations are insufficiently validated. This only affects setups, which are configured to run without a password and only host-based authentication. CVE-2008-1332: Jason Parker discovered that insufficient validation of From: headers inside the SIP channel driver may lead to authentication bypass and the potential external initiation of calls. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||