PT-2008-2923 · Digium+1 · Asterisk Business Edition+4

Jason Parker · Published 2008-03-20 · Updated 2018-10-11 · CVE-2008-1332

Positive Technologies (AI Summary)

CVSS v2.0

8.8

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.2.x through 1.2.26 Asterisk Open Source versions 1.4.x through 1.4.18 Asterisk Business Edition versions A.x.x through B.2.5.0 Asterisk Business Edition versions C.x.x through C.1.6.1 AsteriskNOW versions 1.0.x through 1.0.1 Appliance Developer Kit versions before 1.4 revision 109393 s800i versions 1.0.x through 1.1.0.1

Description The issue allows remote attackers to access the SIP channel driver via a crafted From header.

Recommendations For Asterisk Open Source versions 1.2.x through 1.2.26, update to version 1.2.27 or later. For Asterisk Open Source versions 1.4.x through 1.4.18, update to version 1.4.18.1 or later. For Asterisk Business Edition versions A.x.x through B.2.5.0, update to version B.2.5.1 or later. For Asterisk Business Edition versions C.x.x through C.1.6.1, update to version C.1.6.2 or later. For AsteriskNOW versions 1.0.x through 1.0.1, update to version 1.0.2 or later. For Appliance Developer Kit versions before 1.4 revision 109393, update to revision 109393 or later. For s800i versions 1.0.x through 1.1.0.1, update to version 1.1.0.2 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-1332

DSA-1525-1

Affected Products

Appliance Developer Kit

Asterisk Business Edition

Asterisk Open Source

Asterisknow

S800I

References · 22

• https://security-tracker.debian.org/tracker/CVE-2008-1332 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00514.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00438.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-1332 · Vendor Advisory
• http://debian.org/security/2008/dsa-1525 · Vendor Advisory
• http://secunia.com/advisories/29957 · Vendor Advisory
• http://secunia.com/advisories/29456 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00011.html · Vendor Advisory
• http://downloads.digium.com/pub/security/AST-2008-003.html · Patch
• http://secunia.com/advisories/29782 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200804-13.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1332 · Security Note
• http://secunia.com/advisories/29470 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1332 · Vendor Advisory
• http://secunia.com/advisories/29426 · Vendor Advisory