CVE-2008-1289

Asterisk 1.4.x - RTP Codec Payload Handling Multiple Buffer Overflow Vulnerabilities

Severity Score

7.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit before 1.4 revision 109386, and s800i 1.1.x before 1.1.0.2 allow remote attackers to (1) write a zero to an arbitrary memory location via a large RTP payload number, related to the ast_rtp_unset_m_type function in main/rtp.c; or (2) write certain integers to an arbitrary memory location via a large number of RTP payloads, related to the process_sdp function in channels/chan_sip.c.

Múltiples desbordamientos de búfer en Asterisk Open Source 1.4.x antes de 1.4.18.1 y 1.4.19-rc3, Open Source 1.6.x antes de 1.6.0-beta6, Business Edition C.x.x antes de C.1.6.1, AsteriskNOW 1.0.x antes de 1.0.2, Appliance Developer Kit antes de 1.4 revisión 109386 y s800i 1.1.x antes de 1.1.0.2 permite a atacantes remotos (1) escribir un cero en una posición de memoria de su elección a través de un número de carga útil (payload) RTP grande, relacionada con la función ast_rtp_unset_m_type en main/rtp.c; o (2) escribir ciertos enteros en una posición de memoria de su elección a través de un número grande de cargas útiles RTP, relacionadas con la función process_sdp en channels/chan_sip.c.

*Credits: N/A

CVSS Scores

NISTv2 7.5

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2008-03-12 CVE Reserved
2008-03-18 First Exploit
2008-03-19 CVE Published
2024-08-07 CVE Updated
2024-11-11 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CAPEC

References (15)

URL	Tag	Source
http://downloads.digium.com/pub/security/AST-2008-002.html	X_refsource_confirm
http://secunia.com/advisories/29470	Third Party Advisory
http://securityreason.com/securityalert/3763	Third Party Advisory
http://securitytracker.com/id?1019628	Vdb Entry
http://www.asterisk.org/node/48466	X_refsource_confirm
http://www.securityfocus.com/archive/1/489817/100/0/threaded	Mailing List
http://www.vupen.com/english/advisories/2008/0928	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/41302	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/41305	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/31440	2008-03-18
http://labs.musecurity.com/advisories/MU-200803-01.txt	2024-08-07
http://www.securityfocus.com/bid/28308	2024-08-07

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/29426	2018-10-11
https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00438.html	2018-10-11
https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00514.html	2018-10-11

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Asterisk Search vendor "Asterisk"		Asterisk Appliance Developer Kit Search vendor "Asterisk" for product "Asterisk Appliance Developer Kit"				1.4 Search vendor "Asterisk" for product "Asterisk Appliance Developer Kit" and version "1.4"		-		Affected
Asterisk Search vendor "Asterisk"		Asterisk Business Edition Search vendor "Asterisk" for product "Asterisk Business Edition"				<= c.1.0-beta8 Search vendor "Asterisk" for product "Asterisk Business Edition" and version " <= c.1.0-beta8"		-		Affected
Asterisk Search vendor "Asterisk"		Asterisk Business Edition Search vendor "Asterisk" for product "Asterisk Business Edition"				<= c.1.0beta7 Search vendor "Asterisk" for product "Asterisk Business Edition" and version " <= c.1.0beta7"		-		Affected
Asterisk Search vendor "Asterisk"		Asterisknow Search vendor "Asterisk" for product "Asterisknow"				<= 1.0.1 Search vendor "Asterisk" for product "Asterisknow" and version " <= 1.0.1"		-		Affected
Asterisk Search vendor "Asterisk"		Open Source Search vendor "Asterisk" for product "Open Source"				<= 1.4.18 Search vendor "Asterisk" for product "Open Source" and version " <= 1.4.18"		-		Affected
Asterisk Search vendor "Asterisk"		Open Source Search vendor "Asterisk" for product "Open Source"				<= 1.4.19 Search vendor "Asterisk" for product "Open Source" and version " <= 1.4.19"		rc-2		Affected
Asterisk Search vendor "Asterisk"		Open Source Search vendor "Asterisk" for product "Open Source"				<= 1.6.0_beta5 Search vendor "Asterisk" for product "Open Source" and version " <= 1.6.0_beta5"		-		Affected
Asterisk Search vendor "Asterisk"		S800i Search vendor "Asterisk" for product "S800i"				<= 1.1.0.1 Search vendor "Asterisk" for product "S800i" and version " <= 1.1.0.1"		-		Affected