CVE-2007-4103

The IAX2 channel driver (chan_iax2) in Asterisk Open 1.2.x before 1.2.23, 1.4.x before 1.4.9, and Asterisk Appliance Developer Kit before 0.6.0, when configured to allow unauthenticated calls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake, which causes an ast_channel to be allocated but not released.

• CWE-772

• http://bugs.gentoo.org/show_bug.cgi?id=185713Issue Tracking, Patch
• http://ftp.digium.com/pub/asa/ASA-2007-018.pdfBroken Link, Patch
• http://osvdb.org/38197Broken Link
• http://secunia.com/advisories/26274Broken Link, Patch, Vendor Advisory
• http://secunia.com/advisories/29051Broken Link
• http://security.gentoo.org/glsa/glsa-200802-11.xmlThird Party Advisory
• http://securityreason.com/securityalert/2960Broken Link
• http://www.securityfocus.com/archive/1/475069/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/24950Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1018472Broken Link, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2007/2701Broken Link
• http://bugs.gentoo.org/show_bug.cgi?id=185713Issue Tracking, Patch
• http://ftp.digium.com/pub/asa/ASA-2007-018.pdfBroken Link, Patch
• http://osvdb.org/38197Broken Link
• http://secunia.com/advisories/26274Broken Link, Patch, Vendor Advisory
• http://secunia.com/advisories/29051Broken Link
• http://security.gentoo.org/glsa/glsa-200802-11.xmlThird Party Advisory
• http://securityreason.com/securityalert/2960Broken Link
• http://www.securityfocus.com/archive/1/475069/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/24950Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1018472Broken Link, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2007/2701Broken Link

Published

Jul 31, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-4097Tor before 0.1.2.15 sends "destroy cells" containing the rea…
• CVE-2007-4098Tor before 0.1.2.15 does not properly distinguish "streamids…
• CVE-2007-4099Tor before 0.1.2.15 can select a guard node beyond the first…
• CVE-2007-4100MLDonkey before 2.9.0 does not load certain code from $MLDON…
• CVE-2007-4101Multiple PHP remote file inclusion vulnerabilities in Madoa …
• CVE-2007-4102Cross-site scripting (XSS) vulnerability in search.php for s…
• CVE-2007-4104Multiple cross-site scripting (XSS) vulnerabilities in the W…
• CVE-2007-4105A certain ActiveX control in BaiduBar.dll in Baidu Soba Sear…
• CVE-2007-4106SQL injection vulnerability in login.asp in CodeWidgets Pay …
• CVE-2007-4107SQL injection vulnerability in editpost.php in phpMyForum be…
• CVE-2007-4108SQL injection vulnerability in sign_in.aspx in WebEvents (On…
• CVE-2007-4109SQL injection vulnerability in sign_in.aspx in WebStore (Onl…