CVE-2007-6424
Summary
| CVE | CVE-2007-6424 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2007-12-18 19:46:00 UTC |
| Updated | 2022-04-18 09:37:00 UTC |
| Description | registry.pl in Fonality Trixbox 2.0 PBX products, when running in certain environments, reads and executes a set of commands from a remote web site without sufficiently validating the origin of the commands, which allows remote attackers to disable trixbox and execute arbitrary commands via a DNS spoofing attack. |
Risk And Classification
Problem Types: CWE-264
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| The SuperUnknown » Trixbox phones home | MISC | www.superunknown.org | Exploit |
| [VOIPSEC] Trixbox Arbitrary Command Execution Vulnerability | MLIST | voipsa.org | |
| Voice of VOIPSA » Blog Archive » Trixbox contains “phone home” code to retrieve arbitrary commands to execute? | MISC | voipsa.org | |
| 44136 | OSVDB | osvdb.org | |
| [VOIPSEC] trixbox vulnerability fluff | MLIST | voipsa.org | |
| [VOIPSEC] trixbox vuln (CVE-2007-6424) - PoC exploit code | MLIST | voipsa.org | |
| Trixbox Phones Home | trixbox | MISC | www.trixbox.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.