CVE-2008-0095

Asterisk 1.x - BYE Message Remote Denial of Service

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit before Asterisk 1.4 revision 95946, and Appliance s800i 1.0.x before 1.0.3.4 allows remote attackers to cause a denial of service (daemon crash) via a BYE message with an Also (Also transfer) header, which triggers a NULL pointer dereference.

El controlador de canal SIP de Asterisk Open Source 1.4.x versiones anteriores a 1.4.17, Business Edition versiones anteriores a C.1.0-beta8, AsteriskNOW versiones anteriores a beta7, Appliance Developer Kit versiones anteriores a Asterisk 1.4 revision 95946, y Appliance s800i 1.0.x versiones anteriores a 1.0.3.4 permite a atacantes remotos provocar una denegación de servicio (cáida de demonio) mediante un mensaje BYE con una cabecera Also (tranfiere también), que dispara un referencia a puntero NULL.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2008-01-02 First Exploit
2008-01-07 CVE Reserved
2008-01-08 CVE Published
2024-08-07 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-399: Resource Management Errors

CAPEC

References (13)

URL	Tag	Source
http://secunia.com/advisories/28299	Third Party Advisory
http://securityreason.com/securityalert/3520	Third Party Advisory
http://www.securityfocus.com/archive/1/485727/100/0/threaded	Mailing List
http://www.securitytracker.com/id?1019152	Vdb Entry
http://www.vupen.com/english/advisories/2008/0019	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/39361	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/30974	2008-01-02
http://www.securityfocus.com/bid/27110	2024-08-07

URL	Date	SRC
http://bugs.digium.com/view.php?id=11637	2018-10-15
http://downloads.digium.com/pub/security/AST-2008-001.html	2018-10-15
http://secunia.com/advisories/28312	2018-10-15

URL	Date	SRC
https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00166.html	2018-10-15
https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00167.html	2018-10-15

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Asterisk Search vendor "Asterisk"		Asterisk Appliance Developer Kit Search vendor "Asterisk" for product "Asterisk Appliance Developer Kit"				<= 1.4_revision_95945 Search vendor "Asterisk" for product "Asterisk Appliance Developer Kit" and version " <= 1.4_revision_95945"		-		Affected
Asterisk Search vendor "Asterisk"		Asterisk Business Edition Search vendor "Asterisk" for product "Asterisk Business Edition"				<= c.1.0beta7 Search vendor "Asterisk" for product "Asterisk Business Edition" and version " <= c.1.0beta7"		-		Affected
Asterisk Search vendor "Asterisk"		Asterisknow Search vendor "Asterisk" for product "Asterisknow"				<= beta_6 Search vendor "Asterisk" for product "Asterisknow" and version " <= beta_6"		-		Affected
Asterisk Search vendor "Asterisk"		Open Source Search vendor "Asterisk" for product "Open Source"				<= 1.4.16 Search vendor "Asterisk" for product "Open Source" and version " <= 1.4.16"		-		Affected
Asterisk Search vendor "Asterisk"		S800i Search vendor "Asterisk" for product "S800i"				<= 1.0.3.3 Search vendor "Asterisk" for product "S800i" and version " <= 1.0.3.3"		-		Affected