CVE-2007-3765
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance...
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.
Exploit likelihood
What each source reports
NVD Score used
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.
- Record
CVE-2007-3765- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.
- Record
CVE-2007-3765- Updated
- 2026-11-02
EUVDEUVD-2007-3749 No score
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.
- Record
EUVD-2007-3749- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f9w4-q8jc-qc4v No score
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance...
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.
- Record
GHSA-f9w4-q8jc-qc4v- Updated
- 2026-11-02
OSV No score
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.
- Record
CVE-2007-3765- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-3765 No score
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.
- Record
DEBIAN-CVE-2007-3765- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asteriskDebian:14 |
before 1:1.4.8~dfsg-1, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3 |
1:1.4.8~dfsg-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3765 is a medium vulnerability (CVSS 5.0) in Asterisk, published July 18, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.69%, the 77th percentile. Fixed in asterisk 1:1.4.8~dfsg-1.
References
secunia.com/advisories/26099
securityfocus.com/bid/24950
securitytracker.com/id?1018407
ftp.digium.com/pub/asa/ASA-2007-017.pdf
exchange.xforce.ibmcloud.com/vulnerabilities/35480
vupen.com/english/advisories/2007/2563
nvd.nist.gov/vuln/detail/CVE-2007-3765
github.com/advisories/GHSA-f9w4-q8jc-qc4v
security-tracker.debian.org/tracker/CVE-2007-3765
Left out here: 27 versions. The JSON record has them.