Vulnerability Description
The iax_net_read function in the iaxclient open source library, as used in multiple products including (a) LoudHush 1.3.6, (b) IDE FISK 1.35 and earlier, (c) Kiax 0.8.5 and earlier, (d) DIAX, (e) Ziaxphone, (f) IAX Phone, (g) X-lite, (h) MediaX, (i) Extreme Networks ePhone, and (j) iaxComm before 1.2.0, allows remote attackers to execute arbitrary code via crafted IAX 2 (IAX2) packets with truncated (1) full frames or (2) mini-frames, which are detected in a length check but still processed, leading to buffer overflows related to negative length values.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Loudhush | Loudhush | 1.3.6 |
Related Weaknesses (CWE)
References
- http://iaxclient.sourceforge.net/iaxcomm/
- http://secunia.com/advisories/20466PatchVendor Advisory
- http://secunia.com/advisories/20560Vendor Advisory
- http://secunia.com/advisories/20567Vendor Advisory
- http://secunia.com/advisories/20623Vendor Advisory
- http://secunia.com/advisories/20900Vendor Advisory
- http://sourceforge.net/project/shownotes.php?release_id=423099&group_id=131960
- http://www.coresecurity.com/common/showdoc.php?idx=548&idxseccion=10
- http://www.gentoo.org/security/en/glsa/glsa-200606-30.xml
- http://www.loudhush.ro/changelog.txt
- http://www.securityfocus.com/archive/1/436638/100/0/threaded
- http://www.securityfocus.com/bid/18307Patch
- http://www.vupen.com/english/advisories/2006/2180Vendor Advisory
- http://www.vupen.com/english/advisories/2006/2284Vendor Advisory
- http://www.vupen.com/english/advisories/2006/2285Vendor Advisory
FAQ
What is CVE-2006-2923?
CVE-2006-2923 is a vulnerability with a CVSS score of 6.4 (MEDIUM). The iax_net_read function in the iaxclient open source library, as used in multiple products including (a) LoudHush 1.3.6, (b) IDE FISK 1.35 and earlier, (c) Kiax 0.8.5 and earlier, (d) DIAX, (e) Ziax...
How severe is CVE-2006-2923?
CVE-2006-2923 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-2923?
Check the references section above for vendor advisories and patch information. Affected products include: Loudhush Loudhush.