Evil-DB LogoEvil-DB
← All CVEs

CVE-2006-5444

high · 7.5

Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.

7.5
CVSS
85.3%
EPSS (exploit prob.)
100th
EPSS percentile
2006-10-23
Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

VendorProductAffected versions
digiumasterisk0.1.7
digiumasterisk0.1.8
digiumasterisk0.1.9
digiumasterisk0.1.9.1
digiumasterisk0.2
digiumasterisk0.3
digiumasterisk0.4
digiumasterisk0.7
digiumasterisk0.7.1
digiumasterisk0.7.2
digiumasterisk0.9
digiumasterisk1.0
digiumasterisk1.0.7
digiumasterisk1.0.8
digiumasterisk1.0.9
digiumasterisk1.0.10
digiumasterisk1.0.11
digiumasterisk1.2.6
digiumasterisk1.2.7
digiumasterisk1.2.8
digiumasterisk1.2.9
digiumasterisk1.2.10
digiumasterisk1.2.11
digiumasterisk1.2.12
digiumasterisk1.2_beta1
digiumasterisk1.2_beta2

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2006-5444