PT-2008-3634 · Digium · Asterisk Business Edition+1

Armando.J.M.O

·

Publicado

2008-06-04

·

Atualizado

2018-10-11

·

CVE-2008-2119

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:N/A:P
Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.0.x through 1.2.x before 1.2.29 Asterisk Business Edition versions A.x.x through B.x.x before B.2.5.3
Description The issue allows remote attackers to cause a denial of service, resulting in a daemon crash, via a SIP INVITE message lacking a From header. This is related to the ast uri decode function and improper handling of an empty const string and a NULL pointer when pedantic parsing is enabled.
Recommendations For Asterisk Open Source versions 1.0.x through 1.2.x before 1.2.29, update to version 1.2.29 or later to resolve the issue. For Asterisk Business Edition versions A.x.x through B.x.x before B.2.5.3, update to version B.2.5.3 or later to resolve the issue. As a temporary workaround, consider disabling pedantic parsing to minimize the risk of exploitation.

Exploit

Correção

DoS

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-2119

Produtos afetados

Asterisk Business Edition
Asterisk Open Source