CVE-2007-4280
The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before...
The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population.
Exploit likelihood
What each source reports
NVD Score used
The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population.
- Record
CVE-2007-4280- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population.
- Record
CVE-2007-4280- Updated
- 2026-11-02
EUVDEUVD-2007-4263 No score
The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population.
- Record
EUVD-2007-4263- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3p5p-863p-q64f No score
The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before...
The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population.
- Record
GHSA-3p5p-863p-q64f- Updated
- 2026-11-02
OSV No score
The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population.
- Record
CVE-2007-4280- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-4280 No score
The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population.
- Record
DEBIAN-CVE-2007-4280- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asteriskDebian:14 |
before 1:1.4.10~dfsg-1, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3 |
1:1.4.10~dfsg-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-4280 is a low vulnerability (CVSS 3.5) in Asterisk, published August 9, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.15%, the 67th percentile. Fixed in asterisk 1:1.4.10~dfsg-1.
References
vupen.com/english/advisories/2007/2808
secunia.com/advisories/26340
downloads.digium.com/pub/asa/ASA-2007-019.pdf
exchange.xforce.ibmcloud.com/vulnerabilities/35870
securityfocus.com/bid/25228
securitytracker.com/id?1018536
nvd.nist.gov/vuln/detail/CVE-2007-4280
github.com/advisories/GHSA-3p5p-863p-q64f
security-tracker.debian.org/tracker/CVE-2007-4280
Left out here: 30 versions. The JSON record has them.