PT-2015-6051 · Digium · Asterisk

Maciej Szmigiero · Published 2015-04-10 · Updated 2018-10-09 · CVE-2015-3008

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.8 before 1.8.32.3 Asterisk Open Source versions 11.x before 11.17.1 Asterisk Open Source versions 12.x before 12.8.2 Asterisk Open Source versions 13.x before 13.3.2 Certified Asterisk versions 1.8.28 before 1.8.28-cert5 Certified Asterisk versions 11.6 before 11.6-cert11 Certified Asterisk versions 13.1 before 13.1-cert2

Description The issue arises when registering a SIP TLS device and does not properly handle a null byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate. This allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

Recommendations For Asterisk Open Source version 1.8, update to version 1.8.32.3 or later. For Asterisk Open Source version 11.x, update to version 11.17.1 or later. For Asterisk Open Source version 12.x, update to version 12.8.2 or later. For Asterisk Open Source version 13.x, update to version 13.3.2 or later. For Certified Asterisk version 1.8.28, update to version 1.8.28-cert5 or later. For Certified Asterisk version 11.6, update to version 11.6-cert11 or later. For Certified Asterisk version 13.1, update to version 13.1-cert2 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2015-3008

DLA-455-1

DSA-3700-1

MGASA-2015-0153

Affected Products

Asterisk

References · 24

• https://ubuntu.com/security/CVE-2015-3008 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162260.html · Vendor Advisory
• http://debian.org/security/2016/dsa-3700 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-3008 · Security Note
• https://advisories.mageia.org/MGASA-2015-0153.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-3008 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2015:206 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-3008 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3700-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0153 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3008 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-3008 · Vendor Advisory
• http://downloads.asterisk.org/pub/security/AST-2015-003.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-3008 · Vendor Advisory
• http://securityfocus.com/archive/1/535222/100/0/threaded · Note