PT-2008-2972 · Digium+1 · Asterisk Appliance Developer Kit+4

Published 2008-03-24 · Updated 2018-10-11 · CVE-2008-1390

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.4.x through 1.4.19-rc2 Asterisk Open Source versions 1.6.x through 1.6.0-beta5 Asterisk Business Edition C.x.x through C.1.5 AsteriskNOW versions 1.0 through 1.0.1 Asterisk Appliance Developer Kit versions prior to revision 104704 s800i versions 1.0.x through 1.1.0.1

Description The AsteriskGUI HTTP server generates insufficiently random manager ID values, making it easier for remote attackers to hijack a manager session via a series of ID guesses.

Recommendations For Asterisk Open Source versions 1.4.x through 1.4.19-rc2, update to version 1.4.19-rc3 or later. For Asterisk Open Source versions 1.6.x through 1.6.0-beta5, update to version 1.6.0-beta6 or later. For Asterisk Business Edition C.x.x through C.1.5, update to version C.1.6 or later. For AsteriskNOW versions 1.0 through 1.0.1, update to version 1.0.2 or later. For Asterisk Appliance Developer Kit versions prior to revision 104704, update to revision 104704 or later. For s800i versions 1.0.x through 1.1.0.1, update to version 1.1.0.2 or later.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2008-1390

Affected Products

Asterisk Appliance Developer Kit

Asterisk Business Edition

Asterisk Open Source

Asterisknow

S800I

References · 15

• https://redhat.com/archives/fedora-package-announce/2008-March/msg00514.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1390 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00438.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1390 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2008-1390 · Vendor Advisory
• http://secunia.com/advisories/29449 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-1390 · Vendor Advisory
• http://secunia.com/advisories/29470 · Note
• http://downloads.digium.com/pub/security/AST-2008-005.html · Note
• http://securityfocus.com/bid/28316 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1390 · Note
• http://securityreason.com/securityalert/3764 · Note
• http://securitytracker.com/id?1019679 · Note
• http://securityfocus.com/archive/1/489819/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41304 · Note