CVE-2008-1289
Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit before 1.4 revision 109386, and…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 11.5%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit before 1.4 revision 109386, and s800i 1.1.x before 1.1.0.2 allow remote attackers to (1) write a zero to an arbitrary memory location via a large RTP payload number, related to the ast_rtp_unset_m_type function in main/rtp.c; or (2) write certain integers to an arbitrary memory location via a large number of RTP payloads, related to the process_sdp function in channels/chan_sip.c.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 11.52% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- asterisk/asterisk appliance developer kit · asterisk/asterisk business edition · asterisk/asterisknow · asterisk/open source · asterisk/s800i
- Source
- cve@mitre.org
References
- http://downloads.digium.com/pub/security/AST-2008-002.html
- http://labs.musecurity.com/advisories/MU-200803-01.txtExploit
- http://secunia.com/advisories/29426Vendor Advisory
- http://secunia.com/advisories/29470
- http://securityreason.com/securityalert/3763
- http://securitytracker.com/id?1019628
- http://www.asterisk.org/node/48466
- http://www.securityfocus.com/archive/1/489817/100/0/threaded
- http://www.securityfocus.com/bid/28308Exploit
- http://www.vupen.com/english/advisories/2008/0928
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41302
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41305
- https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00438.html
- https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00514.html
- http://downloads.digium.com/pub/security/AST-2008-002.html
- http://labs.musecurity.com/advisories/MU-200803-01.txtExploit
- http://secunia.com/advisories/29426Vendor Advisory
- http://secunia.com/advisories/29470
- http://securityreason.com/securityalert/3763
- http://securitytracker.com/id?1019628
- http://www.asterisk.org/node/48466
- http://www.securityfocus.com/archive/1/489817/100/0/threaded
- http://www.securityfocus.com/bid/28308Exploit
- http://www.vupen.com/english/advisories/2008/0928
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41302
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41305
- https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00438.html
- https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00514.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.