CVE-2006-5444: Asterisk Skinny channel driver integer overflow enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw is remotely exploitable without authentication, leads to code execution, and has a very high EPSS score with public exploit references, though it is not in CISA KEV.

What it is

The get_input function in Asterisk's Skinny channel driver (chan_skinny.c) contains an integer overflow: a crafted dlen value passes a signed integer comparison and triggers a heap-based buffer overflow. Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13 are affected, and the flaw is reachable over the network without authentication.

Impact

A remote attacker can execute arbitrary code with the privileges of the Asterisk process, potentially taking full control of the telephony server. A crash or denial of service is also possible if the overflow is not exploited for code execution.

Attack surface

The vulnerability is reached over the network through the Skinny/SCCP protocol used by Cisco SCCP phones; the CVSS vector AV:N/AC:L/Au:N indicates no authentication or user interaction is required.

Exploitation

The record is not listed in CISA KEV, but EPSS is very high (0.85332, 99.7th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade Asterisk to 1.0.12 or 1.2.13 (or later) as documented in the vendor changelogs.
• If the Skinny channel driver is not required, disable or unload chan_skinny to remove the attack surface.
• Restrict network access to the Skinny/SCCP service (TCP port 2000 by default) to trusted phone and management networks only.
• Apply vendor or distribution patches (Debian DSA-1229, Gentoo GLSA 200610-15, Novell advisory) where Asterisk is packaged.
• Monitor for and block malformed Skinny packets at network boundaries until patching is complete.

Detection

• Inspect Asterisk logs and Skinny channel driver debug output for malformed or oversized dlen values or protocol parsing errors.
• Use network monitoring to detect anomalous Skinny/SCCP traffic, especially oversized or malformed packets sent to TCP port 2000.
• Monitor for unexpected process crashes or restarts of the Asterisk service that could indicate exploitation attempts.
• Check for signs of post-exploitation activity such as unexpected outbound connections or new processes spawned by Asterisk.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.