PT-2008-2924 · Digium · Asterisk Open Source

Publicado 2008-03-20 · Atualizado 2018-10-11 · CVE-2008-1333

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.6.x before 1.6.0-beta6

Description The issue is related to a format string vulnerability that could potentially allow remote attackers to execute arbitrary code. This is due to the improper handling of logging messages by the ast verbose logging API call or the astman append function.

Recommendations For Asterisk Open Source versions 1.6.x before 1.6.0-beta6, update to version 1.6.0-beta6 or later to resolve the issue. As a temporary workaround, consider restricting access to the ast verbose logging API call and the astman append function until a patch is applied.

Correção

RCE

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2008-1333

DSA-1525-1

Produtos afetados

Asterisk Open Source

Referências · 15

• https://security-tracker.debian.org/tracker/CVE-2008-1333 · Aviso do Fabricante
• http://downloads.digium.com/pub/security/AST-2008-004.html · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41301 · Nota
• http://debian.org/security/2008/dsa-1525 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2008-1333 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1333 · Nota
• http://secunia.com/advisories/29426 · Nota
• http://securityfocus.com/archive/1/489823/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1333 · Nota de Segurança
• http://securityfocus.com/bid/28311 · Nota
• http://asterisk.org/node/48466 · Nota
• http://secunia.com/advisories/29456 · Nota
• http://vupen.com/english/advisories/2008/0928 · Nota
• http://securitytracker.com/id?1019630 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1333 · Aviso do Fabricante