In the Skinny channel driver, KEYPAD_BUTTON_MESSAGE events are queued for processing in a buffer allocated on the heap, where each DTMF value that is received is placed on the end of the buffer. Since the length of the buffer is never checked,..
The post Heap Buffer Overflow in Skinny Channel Driver first appeared on AsteriskFAQs.
