Skip to content
Fencer Vulns
high 7.6

CVE-2007-2293 in the critical feed json

Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3…

published 2007-04-26 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-2288

cvss
7.6
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
23.9%
EPSS 23.9% chance of exploitation in 30 days, percentile 97%
public exploits
2
Exploit-DB

Summary

Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3 allow remote attackers to execute arbitrary code via a long (1) T38FaxRateManagement or (2) T38FaxUdpEC SDP parameter in an SIP message, as demonstrated using SIP INVITE.

Patch / fix

  • asterisk Debian 14 1:1.4.3~dfsg-1

debian advisories DEBIAN-CVE-2007-2293

Timeline

  1. First public exploit (EDB-29901)
  2. Published

Exploit prediction

23.88% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-29901 Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow (PoC) (2) dos, 2007-03-21
  • EDB-29900 Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow (PoC) (1) dos, 2007-03-21
  • securityfocus.com http://www.securityfocus.com/bid/23648 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.