Asterisk Project Security Advisory – The Asterisk Skinny channel driver, chan_skinny, has a remotely exploitable crash vulnerability. A segfault can occur when Asterisk receives a packet where the claimed length of the data is between 0 and 3, followed by length + 4 or more bytes, due to an overly large memcpy. The side effects of this extremely large memcpy have not been investigated.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/57818/ASA-2007-016.txt
Source: https://packetstormsecurity.com/files/57818/ASA-2007-016.txt.html