PT-2008-2881 · Digium · Asterisk Appliance Developer Kit+4

Published 2008-03-24 · Updated 2018-10-11 · CVE-2008-1289

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.4.x through 1.4.18.1 Asterisk Open Source versions 1.6.x through 1.6.0-beta6 Asterisk Business Edition C.x.x through C.1.6.1 AsteriskNOW versions 1.0.x through 1.0.2 Asterisk Appliance Developer Kit before 1.4 revision 109386 Asterisk s800i versions 1.1.x through 1.1.0.2

Description The issue is related to multiple buffer overflows that allow remote attackers to write to arbitrary memory locations. This can be achieved via a large RTP payload number, which is related to the ast rtp unset m type function in main/rtp.c, or by sending a large number of RTP payloads, which is related to the process sdp function in channels/chan sip.c.

Recommendations For Asterisk Open Source versions 1.4.x through 1.4.18.1, update to version 1.4.18.1 or later. For Asterisk Open Source versions 1.6.x through 1.6.0-beta6, update to version 1.6.0-beta6 or later. For Asterisk Business Edition C.x.x through C.1.6.1, update to version C.1.6.1 or later. For AsteriskNOW versions 1.0.x through 1.0.2, update to version 1.0.2 or later. For Asterisk Appliance Developer Kit before 1.4 revision 109386, update to 1.4 revision 109386 or later. For Asterisk s800i versions 1.1.x through 1.1.0.2, update to version 1.1.0.2 or later.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-1289

Affected Products

Asterisk Appliance Developer Kit

Asterisk Business Edition

Asterisk Open Source

Asterisk S800I

Asterisknow

References · 20

• 🔥 http://securityfocus.com/bid/28308 · Exploit
• 🔥 http://labs.musecurity.com/advisories/MU-200803-01.txt · Exploit
• 🔥 https://exploit-db.com/exploits/31440 · Exploit
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00514.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00438.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-1289 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-1289 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1289 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1289 · Vendor Advisory
• http://secunia.com/advisories/29426 · Vendor Advisory
• http://secunia.com/advisories/29470 · Note
• http://downloads.digium.com/pub/security/AST-2008-002.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41305 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1289 · Note
• http://securityfocus.com/archive/1/489817/100/0/threaded · Note