PT-2008-2881 · Digium · Asterisk Appliance Developer Kit+4

Publicado 2008-03-24 · Atualizado 2018-10-11 · CVE-2008-1289

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.4.x through 1.4.18.1 Asterisk Open Source versions 1.6.x through 1.6.0-beta6 Asterisk Business Edition C.x.x through C.1.6.1 AsteriskNOW versions 1.0.x through 1.0.2 Asterisk Appliance Developer Kit before 1.4 revision 109386 Asterisk s800i versions 1.1.x through 1.1.0.2

Description The issue is related to multiple buffer overflows that allow remote attackers to write to arbitrary memory locations. This can be achieved via a large RTP payload number, which is related to the ast rtp unset m type function in main/rtp.c, or by sending a large number of RTP payloads, which is related to the process sdp function in channels/chan sip.c.

Recommendations For Asterisk Open Source versions 1.4.x through 1.4.18.1, update to version 1.4.18.1 or later. For Asterisk Open Source versions 1.6.x through 1.6.0-beta6, update to version 1.6.0-beta6 or later. For Asterisk Business Edition C.x.x through C.1.6.1, update to version C.1.6.1 or later. For AsteriskNOW versions 1.0.x through 1.0.2, update to version 1.0.2 or later. For Asterisk Appliance Developer Kit before 1.4 revision 109386, update to 1.4 revision 109386 or later. For Asterisk s800i versions 1.1.x through 1.1.0.2, update to version 1.1.0.2 or later.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-1289

Produtos afetados

Asterisk Appliance Developer Kit

Asterisk Business Edition

Asterisk Open Source

Asterisk S800I

Asterisknow

Referências · 20

• 🔥 http://securityfocus.com/bid/28308 · Exploit
• 🔥 http://labs.musecurity.com/advisories/MU-200803-01.txt · Exploit
• 🔥 https://exploit-db.com/exploits/31440 · Exploit
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00514.html · Aviso do Fabricante
• http://secunia.com/advisories/29470 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00438.html · Aviso do Fabricante
• http://downloads.digium.com/pub/security/AST-2008-002.html · Nota
• https://osv.dev/vulnerability/CVE-2008-1289 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41305 · Nota
• https://security-tracker.debian.org/tracker/CVE-2008-1289 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1289 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1289 · Nota de Segurança
• http://securityfocus.com/archive/1/489817/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41302 · Nota
• http://securitytracker.com/id?1019628 · Nota