VDB
CVE-2006-2923
CVE-2006-2923
PUBLISHED
CVSS 6.400000095367432 MEDIUM
The iax_net_read function in the iaxclient open source library, as used in multiple products including (a) LoudHush 1.3.6, (b) IDE FISK 1.35 and earlier, (c) Kiax 0.8.5 and earlier, (d) DIAX, (e) Ziaxphone, (f) IAX Phone, (g) X-lite, (h) MediaX, (i) Extreme Networks ePhone, and (j) iaxComm before 1.2.0, allows remote attackers to execute arbitrary code via crafted IAX 2 (IAX2) packets with truncated (1) full frames or (2) mini-frames, which are detected in a length check but still processed, leading to buffer overflows related to negative length values.
EPSS 11.20% · 93.7th percentile
Risk Scores
CVSS 2.0
6.400000095367432
EPSS Score
11.20%
93.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| loudhush | loudhush | 1.3.6 |
| n/a | n/a | n/a |
Timeline
- Jun 9, 2006 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
- Aug 5, 2023 EPSS Score
References
- ADV-2006-2286 vdb
- ADV-2006-2285 vdb
- iaxclient-truncated-frame-bo(27047) vdb
- http://www.loudhush.ro/changelog.txt url
- 20567 third-party-advisory
- http://iaxclient.sourceforge.net/iaxcomm/ url
- 20900 third-party-advisory
- http://www.coresecurity.com/common/showdoc.php?idx=548&idxseccion=10 url
- ADV-2006-2180 vdb
- 20623 third-party-advisory
- 20466 third-party-advisory
- 18307 vdb
- ADV-2006-2284 vdb
- 20060609 CORE-2006-0327: IAXclient truncated frames vulnerabilities mailing-list
- GLSA-200606-30 vendor-advisory
- http://sourceforge.net/project/shownotes.php?release_id=423099&group_id=131960 url
- 20560 third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2006-2923 advisory
- http://iaxclient.sourceforge.net/iaxcomm url