CVE-2006-5444
Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in...
Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.
- Record
CVE-2006-5444- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.
- Record
CVE-2006-5444- Updated
- 2026-11-02
EUVDEUVD-2006-5429 No score
Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.
- Record
EUVD-2006-5429- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j3p4-x4g4-jfg2 No score
Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in...
Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.
- Record
GHSA-j3p4-x4g4-jfg2- Updated
- 2026-11-02
OSV No score
Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.
- Record
CVE-2006-5444- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-5444 No score
Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.
- Record
DEBIAN-CVE-2006-5444- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asteriskDebian:14 |
before 1:1.2.13~dfsg-1, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.4.dfsg-11:1.2.4.dfsg-21:1.2.4.dfsg-31:1.2.4.dfsg-41:1.2.4.dfsg-51:1.2.4.dfsg-61:1.2.4.dfsg-6+b11:1.2.4.dfsg-71:1.2.7.1.dfsg-1 |
1:1.2.13~dfsg-1 |
asteriskDebian:3.1 |
before 1:1.0.7.dfsg.1-2sarge4, plus listed versions 1:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge3 |
1:1.0.7.dfsg.1-2sarge4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Asterisk 1.0.12/1.2.12.1 - 'chan_skinny' Remote Heap Overflow (PoC) | 2006-10-19 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-5444 is a high vulnerability (CVSS 7.5) in Digium Asterisk, published October 23, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 86.5%, the 99th percentile. Fixed in asterisk 1:1.2.13~dfsg-1.
References
secunia.com/advisories/22480
ftp.digium.com/pub/asterisk/releases/ChangeLog-1.2.13
us.debian.org/security/2006/dsa-1229
gentoo.org/security/en/glsa/glsa-200610-15.xml
novell.com/linux/security/advisories/2006_69_asterisk.html
securityfocus.com/bid/20617
Show 16 moreShow less
vupen.com/english/advisories/2006/4097
osvdb.org/29972
lists.grok.org.uk/pipermail/full-disclosure/2006-October/050171.html
exchange.xforce.ibmcloud.com/vulnerabilities/29663
kb.cert.org/vuls/id/521252
securitytracker.com/id?1017089
asterisk.org/node/109
nvd.nist.gov/vuln/detail/CVE-2006-5444
github.com/advisories/GHSA-j3p4-x4g4-jfg2
security-tracker.debian.org/tracker/CVE-2006-5444
Left out here: 3 versions. The JSON record has them.