PT-2008-2924 · Digium · Asterisk Open Source

Published 2008-03-20 · Updated 2018-10-11 · CVE-2008-1333

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.6.x before 1.6.0-beta6

Description The issue is related to a format string vulnerability that could potentially allow remote attackers to execute arbitrary code. This is due to the improper handling of logging messages by the ast verbose logging API call or the astman append function.

Recommendations For Asterisk Open Source versions 1.6.x before 1.6.0-beta6, update to version 1.6.0-beta6 or later to resolve the issue. As a temporary workaround, consider restricting access to the ast verbose logging API call and the astman append function until a patch is applied.

Fix

RCE

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2008-1333

DSA-1525-1

Affected Products

Asterisk Open Source

References · 15

• https://security-tracker.debian.org/tracker/CVE-2008-1333 · Vendor Advisory
• http://downloads.digium.com/pub/security/AST-2008-004.html · Patch
• http://debian.org/security/2008/dsa-1525 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-1333 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1333 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1333 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41301 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1333 · Note
• http://secunia.com/advisories/29426 · Note
• http://securityfocus.com/archive/1/489823/100/0/threaded · Note
• http://securityfocus.com/bid/28311 · Note
• http://asterisk.org/node/48466 · Note
• http://secunia.com/advisories/29456 · Note
• http://vupen.com/english/advisories/2008/0928 · Note
• http://securitytracker.com/id?1019630 · Note