4015 matches found
Debian: Security Advisory (DSA-1563-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian Security Advisory DSA 1563-1 (asterisk)
The remote host is missing an update to asterisk announced via advisory DSA 1563-1. OpenVAS Vulnerability Test $Id: deb15631.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1563-1 asterisk Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
Asterisk SIP Remote Authentication Bypass
The version of Asterisk running on the remote host allows unauthenticated calls via the SIP channel driver. Using a specially crafted From header, a remote attacker can bypass authentication and make calls into the context specified in the 'general' section of 'sip.conf'. %NASLMINLEVEL 70300 C...
Asterisk IAX2 Multiple Method Handshake Spoofing DoS
The version of Asterisk running on the remote host does not properly validate an IAX2 handshake. By spoofing NEW and ACK messages, an unauthenticated, remote attacker may be able to leverage this issue to flood a third-party host with packets from the affected host containing audio data. C Tenabl...
Debian DSA-1563-1 : asterisk - programming error
Joel R. Voss discovered that the IAX2 module of Asterisk, a free software PBX and telephony toolkit performs insufficient validation of IAX2 protocol messages, which may lead to denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...
Fedora 7 : asterisk-1.4.19.1-1.fc7 (2008-3365)
Fixes security bug found in IAX2: http://downloads.digium.com/pub/security/AST-2008-006.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...
Fedora 8 : asterisk-1.4.19.1-1.fc8 (2008-3390)
Fixes security bug found in IAX2: http://downloads.digium.com/pub/security/AST-2008-006.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...
[SECURITY] [DSA 1563-1] New asterisk packages fix denial of service
------------------------------------------------------------------------ Debian Security Advisory DSA-1563-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff April 30, 2008 http://www.debian.org/security/faq -...
DSA-1563-1 asterisk - denial of service
Bulletin has no description...
[SECURITY] Fedora 8 Update: asterisk-1.4.19.1-1.fc8
Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...
Update Protection against Asterisk Buffer Overflow Vulnerabilities
Two buffer overflow vulnerabilities have been reported in the RTP payload handling code of Asterisk that could allow remote attackers to execute arbitrary code...
Asterisk IAX2报文放大远程拒绝服务漏洞
BUGTRAQ ID: 28901 CVECAN ID: CVE-2008-1897 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 Asterisk在处理呼叫的机制上存在漏洞，远程攻击者可能利用此漏洞对第三方机器执行拒绝服务攻击。 IAX2协议允许ICNEW报文启动呼叫。ICNEW报文是18字节长的UDP报文，而呼叫可能非常长，包含有很多数据。由于UDP是可以伪造的，因此远程攻击者可以在IAX2握手期间欺骗IAX2握手，导致Asterisk服务器向目标发送大量数据，造成网络堵塞。 Asterisk Asterisk 1.4.x Asterisk Asterisk...
AST-2008-006 - 3-way handshake in IAX2 incomplete
Asterisk Project Security Advisory - AST-2008-006 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | 3-way handshake in IAX2 incomplete |...
Asterisk IAX2 calls spoofing
Insuficient check of server ACK and weak call number generation allows blind spoofing...
Code injection
The IAX2 channel driver chaniax2 in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow...
Code injection
The IAX2 channel driver chaniax2 in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "early audio" to an unverified source IP address of a NEW message, which allows remote attackers to cause a denial of service traffic...
CVE-2008-1923
The IAX2 channel driver chaniax2 in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "early audio" to an unverified source IP address of a NEW message, which allows remote attackers to cause a denial of service traffic...
CVE-2008-1897
The IAX2 channel driver chaniax2 in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow...
CVE-2008-1897
The IAX2 channel driver chaniax2 in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow...
CVE-2008-1923
The IAX2 channel driver chaniax2 in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "early audio" to an unverified source IP address of a NEW message, which allows remote attackers to cause a denial of service traffic...