CVE-2008-2119

Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing aka pedanticsipchecking is enabled, allows remote attackers to cause a denial of service daemon crash via a SIP INVITE message that lacks a From header, related to...

DEBIAN-CVE-2008-2119

Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing aka pedanticsipchecking is enabled, allows remote attackers to cause a denial of service daemon crash via a SIP INVITE message that lacks a From header, related to...

CVE-2008-2119

Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing aka pedanticsipchecking is enabled, allows remote attackers to cause a denial of service daemon crash via a SIP INVITE message that lacks a From header, related to...

CVE-2008-2119

CVE-2008-2119 affects Asterisk Open Source 1.0.x and 1.2.x (pre-1.2.29) and Business Edition A.x.x/B.x.x (pre-B.2.5.3). In pedantic parsing, From header null/empty values are fed to ast_uri_decode, causing a remote DoS (daemon crash). OpenVAS/Gentoo advisories document this and recommend upgradin...

CVE-2008-2119

Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing aka pedanticsipchecking is enabled, allows remote attackers to cause a denial of service daemon crash via a SIP INVITE message that lacks a From header, related to...

Debian: Security Advisory (DSA-1563-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 1563-1 (asterisk)

The remote host is missing an update to asterisk announced via advisory DSA 1563-1. OpenVAS Vulnerability Test $Id: deb15631.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1563-1 asterisk Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Asterisk SIP Remote Authentication Bypass

The version of Asterisk running on the remote host allows unauthenticated calls via the SIP channel driver. Using a specially crafted From header, a remote attacker can bypass authentication and make calls into the context specified in the 'general' section of 'sip.conf'. %NASLMINLEVEL 70300 C...

Asterisk IAX2 Multiple Method Handshake Spoofing DoS

The version of Asterisk running on the remote host does not properly validate an IAX2 handshake. By spoofing NEW and ACK messages, an unauthenticated, remote attacker may be able to leverage this issue to flood a third-party host with packets from the affected host containing audio data. C Tenabl...

Debian DSA-1563-1 : asterisk - programming error

Joel R. Voss discovered that the IAX2 module of Asterisk, a free software PBX and telephony toolkit performs insufficient validation of IAX2 protocol messages, which may lead to denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Fedora 7 : asterisk-1.4.19.1-1.fc7 (2008-3365)

Fixes security bug found in IAX2: http://downloads.digium.com/pub/security/AST-2008-006.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...

Fedora 8 : asterisk-1.4.19.1-1.fc8 (2008-3390)

Fixes security bug found in IAX2: http://downloads.digium.com/pub/security/AST-2008-006.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...

[SECURITY] [DSA 1563-1] New asterisk packages fix denial of service

------------------------------------------------------------------------ Debian Security Advisory DSA-1563-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff April 30, 2008 http://www.debian.org/security/faq -...

DSA-1563-1 asterisk - denial of service

Bulletin has no description...

[SECURITY] Fedora 8 Update: asterisk-1.4.19.1-1.fc8

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...

Update Protection against Asterisk Buffer Overflow Vulnerabilities

Two buffer overflow vulnerabilities have been reported in the RTP payload handling code of Asterisk that could allow remote attackers to execute arbitrary code...

Asterisk IAX2报文放大远程拒绝服务漏洞

BUGTRAQ ID: 28901 CVECAN ID: CVE-2008-1897 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 Asterisk在处理呼叫的机制上存在漏洞，远程攻击者可能利用此漏洞对第三方机器执行拒绝服务攻击。 IAX2协议允许ICNEW报文启动呼叫。ICNEW报文是18字节长的UDP报文，而呼叫可能非常长，包含有很多数据。由于UDP是可以伪造的，因此远程攻击者可以在IAX2握手期间欺骗IAX2握手，导致Asterisk服务器向目标发送大量数据，造成网络堵塞。 Asterisk Asterisk 1.4.x Asterisk Asterisk...

Asterisk IAX2 calls spoofing

Insuficient check of server ACK and weak call number generation allows blind spoofing...

AST-2008-006 - 3-way handshake in IAX2 incomplete

Asterisk Project Security Advisory - AST-2008-006 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | 3-way handshake in IAX2 incomplete |...

CVE-2008-1897

The IAX2 channel driver chaniax2 in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow...