CVE-2008-1289

Published Mar 24, 2008

Last updated 6 years ago

Overview

Description: Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit before 1.4 revision 109386, and s800i 1.1.x before 1.1.0.2 allow remote attackers to (1) write a zero to an arbitrary memory location via a large RTP payload number, related to the ast_rtp_unset_m_type function in main/rtp.c; or (2) write certain integers to an arbitrary memory location via a large number of RTP payloads, related to the process_sdp function in channels/chan_sip.c.
Source: cve@mitre.org
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 7.5
Impact score: 6.4
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-119

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:1.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7E2D0508-C418-48CE-BF83-39F893688D1C"
          },
          {
            "criteria": "cpe:2.3:a:asterisk:asterisk_business_edition:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1A80C0F3-F3F0-4BC6-92F8-131F3F875E34",
            "versionEndIncluding": "c.1.0-beta8"
          },
          {
            "criteria": "cpe:2.3:a:asterisk:asterisk_business_edition:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "526991C1-D07E-465C-A609-704C19F8096A",
            "versionEndIncluding": "c.1.0beta7"
          },
          {
            "criteria": "cpe:2.3:a:asterisk:asterisknow:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B7C58E6B-AECC-48AF-8059-61772690776A",
            "versionEndIncluding": "1.0.1"
          },
          {
            "criteria": "cpe:2.3:a:asterisk:open_source:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E7F13399-5084-40FA-A4AB-D78ED588E434",
            "versionEndIncluding": "1.4.18"
          },
          {
            "criteria": "cpe:2.3:a:asterisk:open_source:*:rc-2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F4AB8D8F-15AC-4516-85A2-B5D2B5B3DF04",
            "versionEndIncluding": "1.4.19"
          },
          {
            "criteria": "cpe:2.3:a:asterisk:open_source:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "53B339C1-272B-4A7E-A342-8BBD9DC82826",
            "versionEndIncluding": "1.6.0_beta5"
          },
          {
            "criteria": "cpe:2.3:a:asterisk:s800i:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6D1E04DC-AE6A-4536-8E45-36494E51B036",
            "versionEndIncluding": "1.1.0.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References