PT-2008-3425 · Digium+1 · Asterisk Business Edition+4

Javantea + 1 · Published 2008-04-23 · Updated 2023-10-20 · CVE-2008-1897

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.0.x through 1.2.27 and versions 1.4.x through 1.4.18 Asterisk Business Edition versions A.x.x through B.2.5.1 and versions C.x.x through C.1.8.0 AsteriskNOW versions prior to 1.0.3 Appliance Developer Kit versions 0.x.x s800i versions prior to 1.1.0.3

Description The issue allows remote attackers to cause a denial of service via a spoofed ACK response that does not complete a 3-way handshake, resulting in traffic amplification. This occurs when the IAX2 channel driver is configured to allow unauthenticated calls and fails to verify that an ACK response contains a call number matching the server's reply to a NEW message.

Recommendations For Asterisk Open Source versions 1.0.x through 1.2.27, update to version 1.2.28 or later. For Asterisk Open Source versions 1.4.x through 1.4.18, update to version 1.4.19.1 or later. For Asterisk Business Edition versions A.x.x through B.2.5.1, update to version B.2.5.2 or later. For Asterisk Business Edition versions C.x.x through C.1.8.0, update to version C.1.8.1 or later. For AsteriskNOW versions prior to 1.0.3, update to version 1.0.3 or later. For Appliance Developer Kit versions 0.x.x, there is no information about a newer version that contains a fix for this issue. For s800i versions prior to 1.1.0.3, update to version 1.1.0.3 or later.

Fix

DoS

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-1897

DSA-1563-1

Affected Products

Appliance Developer Kit

Asterisk Business Edition

Asterisk Open Source

Asterisknow

S800I

References · 32

• http://secunia.com/advisories/29927 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1897 · Security Note
• http://secunia.com/advisories/30010 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-1897 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1897 · Vendor Advisory
• http://secunia.com/advisories/30042 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200905-01.xml · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-April/msg00581.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-April/msg00600.html · Vendor Advisory
• http://debian.org/security/2008/dsa-1563 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-1897 · Vendor Advisory
• https://github.com/mojolingo/asterisk/commit/20ac3662f137dbf7f42d5295590069a7d3b1166b · Note
• https://github.com/jcollie/asterisk/commit/60de4fbbdf3ede49f158e23a9e3b679f2e519c1e · Note
• https://github.com/jcollie/asterisk/commit/a8b180875b037b8da26f6a3bcc8e5e98b8c904d2 · Note
• https://github.com/jcollie/asterisk/commit/771b3d8749b34b6eea4e03a2e514380da9582f90 · Note