PT-2008-2923 · Digium+1 · Asterisk Business Edition+4

Jason Parker · Publicado 2008-03-20 · Atualizado 2018-10-11 · CVE-2008-1332

Positive Technologies (AI Summary)

CVSS v2.0

8.8

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.2.x through 1.2.26 Asterisk Open Source versions 1.4.x through 1.4.18 Asterisk Business Edition versions A.x.x through B.2.5.0 Asterisk Business Edition versions C.x.x through C.1.6.1 AsteriskNOW versions 1.0.x through 1.0.1 Appliance Developer Kit versions before 1.4 revision 109393 s800i versions 1.0.x through 1.1.0.1

Description The issue allows remote attackers to access the SIP channel driver via a crafted From header.

Recommendations For Asterisk Open Source versions 1.2.x through 1.2.26, update to version 1.2.27 or later. For Asterisk Open Source versions 1.4.x through 1.4.18, update to version 1.4.18.1 or later. For Asterisk Business Edition versions A.x.x through B.2.5.0, update to version B.2.5.1 or later. For Asterisk Business Edition versions C.x.x through C.1.6.1, update to version C.1.6.2 or later. For AsteriskNOW versions 1.0.x through 1.0.1, update to version 1.0.2 or later. For Appliance Developer Kit versions before 1.4 revision 109393, update to revision 109393 or later. For s800i versions 1.0.x through 1.1.0.1, update to version 1.1.0.2 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-1332

DSA-1525-1

Produtos afetados

Appliance Developer Kit

Asterisk Business Edition

Asterisk Open Source

Asterisknow

S800I

Referências · 22

• https://security-tracker.debian.org/tracker/CVE-2008-1332 · Aviso do Fabricante
• http://securityfocus.com/bid/28310 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00514.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41308 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00438.html · Aviso do Fabricante
• http://securityfocus.com/archive/1/489818/100/0/threaded · Nota
• https://osv.dev/vulnerability/CVE-2008-1332 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/0928 · Nota
• http://debian.org/security/2008/dsa-1525 · Aviso do Fabricante
• http://secunia.com/advisories/29957 · Aviso do Fabricante
• http://secunia.com/advisories/29456 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00011.html · Aviso do Fabricante
• http://securitytracker.com/id?1019629 · Nota
• http://downloads.digium.com/pub/security/AST-2008-003.html · Correção
• http://secunia.com/advisories/29782 · Aviso do Fabricante