CVE-2007-1561
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to...
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.
Exploit likelihood
What each source reports
NVD Score used
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.
- Record
CVE-2007-1561- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Updated
- 2026-11-02
CVE List No score
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.
- Record
CVE-2007-1561- Updated
- 2026-11-02
EUVDEUVD-2007-1555 No score
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.
- Record
EUVD-2007-1555- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jwxq-x6h2-p3qv No score
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to...
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.
- Record
GHSA-jwxq-x6h2-p3qv- Updated
- 2026-11-02
OSV No score
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.
- Record
CVE-2007-1561- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-1561 No score
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.
- Record
DEBIAN-CVE-2007-1561- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asteriskDebian:14 |
before 1:1.4.2~dfsg-5, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3 |
1:1.4.2~dfsg-5 |
asteriskDebian:4.0 From an advisory covering 8 CVEs |
before 1:1.2.13~dfsg-2etch1, plus listed versions 1:1.2.13~dfsg-2 |
1:1.2.13~dfsg-2etch1 |
asteriskDebian:3.1 From an advisory covering 8 CVEs |
before 1:1.0.7.dfsg.1-2sarge5, plus listed versions 1:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge4 |
1:1.0.7.dfsg.1-2sarge5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Asterisk 1.2.16/1.4.1 - SIP INVITE Remote Denial of Service | 2007-03-25 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| aliases | ||
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-1561 is a high vulnerability (CVSS 7.8) in Asterisk, published March 21, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 14.9%, the 96th percentile. Fixed in asterisk 1:1.4.2~dfsg-5.
References
securitytracker.com/id?1017794
marc.info?l=full-disclosure&m=117432783011737&w=2
secunia.com/advisories/24564
asterisk.org/node/48339
novell.com/linux/security/advisories/2007_34_asterisk.html
securityfocus.com/archive/1/463434/100/0/threaded
Show 13 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/33068
security.gentoo.org/glsa/glsa-200704-01.xml
sineapps.com/news.php?rssid=1707
vupen.com/english/advisories/2007/1039
debian.org/security/2007/dsa-1358
osvdb.org/34479
voipsa.org/pipermail/voipsec_voipsa.org/2007-March/002275.html
nvd.nist.gov/vuln/detail/CVE-2007-1561
github.com/advisories/GHSA-jwxq-x6h2-p3qv
security-tracker.debian.org/tracker/CVE-2007-1561
Left out here: 20 versions. The JSON record has them.