CVE-2007-3765: Asterisk

Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days.

The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.

Affected products

• Asterisk Asterisk: version 1.0 only; version 1.0.6 only; version 1.0.7 only; version 1.0.8 only; version 1.0.9 only; version 1.0.10 only; …
• Asterisk Asterisk Appliance Developer Kit: up to and including 0.4
• Asterisk Asterisknow: version beta_5 only; version beta_6 only
• Asterisk s800i Appliance: version 1.0 only; version 1.0.1 only

Published 2007-07-18. Last modified 2026-06-16.