CVE-2007-1306
Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of...
Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol (SIP) packet without a URI and SIP-version header, which results in a NULL pointer dereference.
Exploit likelihood
What each source reports
NVD Score used
Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol (SIP) packet without a URI and SIP-version header, which results in a NULL pointer dereference.
- Record
CVE-2007-1306- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Updated
- 2026-11-02
CVE List No score
Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol (SIP) packet without a URI and SIP-version header, which results in a NULL pointer dereference.
- Record
CVE-2007-1306- Updated
- 2026-11-02
EUVDEUVD-2007-1303 No score
Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol (SIP) packet without a URI and SIP-version header, which results in a NULL pointer dereference.
- Record
EUVD-2007-1303- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j5g7-pvcx-38pp No score
Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of...
Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol (SIP) packet without a URI and SIP-version header, which results in a NULL pointer dereference.
- Record
GHSA-j5g7-pvcx-38pp- Updated
- 2026-11-02
OSV No score
Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol (SIP) packet without a URI and SIP-version header, which results in a NULL pointer dereference.
- Record
CVE-2007-1306- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-1306 No score
Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol (SIP) packet without a URI and SIP-version header, which results in a NULL pointer dereference.
- Record
DEBIAN-CVE-2007-1306- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asteriskDebian:14 |
before 1:1.2.16~dfsg-1, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3 |
1:1.2.16~dfsg-1 |
asteriskDebian:4.0 From an advisory covering 8 CVEs |
before 1:1.2.13~dfsg-2etch1, plus listed versions 1:1.2.13~dfsg-2 |
1:1.2.13~dfsg-2etch1 |
asteriskDebian:3.1 From an advisory covering 8 CVEs |
before 1:1.0.7.dfsg.1-2sarge5, plus listed versions 1:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge4 |
1:1.0.7.dfsg.1-2sarge5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Asterisk 1.2.15/1.4.0 - Remote Denial of Service | 2007-03-04 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| aliases | ||
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-1306 is a high vulnerability (CVSS 7.8) in Digium Asterisk, published March 7, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 20.9%, the 97th percentile. Fixed in asterisk 1:1.2.16~dfsg-1.
References
vupen.com/english/advisories/2007/0830
securityfocus.com/bid/22838
osvdb.org/33888
secunia.com/advisories/24578
asterisk.org/node/48319
novell.com/linux/security/advisories/2007_34_asterisk.html
Show 12 moreShow less
labs.musecurity.com/advisories/MU-200703-01.txt
exchange.xforce.ibmcloud.com/vulnerabilities/32830
security.gentoo.org/glsa/glsa-200703-14.xml
securitytracker.com/id?1017723
kb.cert.org/vuls/id/228032
debian.org/security/2007/dsa-1358
nvd.nist.gov/vuln/detail/CVE-2007-1306
github.com/advisories/GHSA-j5g7-pvcx-38pp
security-tracker.debian.org/tracker/CVE-2007-1306
Left out here: 14 versions. The JSON record has them.