CVE-2008-1897

The CVE-2008-1897 issue affects the IAX2 channel driver in Asterisk Open Source (various 1.0.x, 1.2.x before 1.2.28, 1.4.x before 1.4.19.1; AsteriskNOW; Business Editions; and s800i prior to listed versions). The vulnerability arises when unauthenticated calls are allowed and the ACK response doe...

CVE-2008-1332

CVE-2008-1332 affects Asterisk and several build variants (1.2.x up to 1.2.27; 1.4.x up to 1.4.18.1 and 1.4.19-rc3; AsteriskNOW, Business/Community editions, Appliance Kit, s800i) and allows remote attackers to access the SIP channel driver via a crafted From header, bypassing authentication. Con...

CVE-2008-1390

CVE-2008-1390 affects the AsteriskGUI HTTP server as used in Asterisk Open Source 1.4.x (before 1.4.19-rc3) and 1.6.x (before 1.6.0-beta6), plus various bundles. The vulnerability arises from generating insufficiently random manager ID values, which can allow remote attackers to hijack a manager ...

CVE-2007-4280

The CVE-2007-4280 issue affects the Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3. The vulnerability arises when processing a CAPABILITIES_RES_MESSAGE packet containing a ...

CVE-2008-0095

Asterisk Open Source 1.4.x (and related editions) is affected by a remote DoS via a crafted BYE message containing an Also header, triggering a NULL pointer dereference and daemon crash. The vulnerable range includes 1.4.x before 1.4.17, with affected builds in Business Edition before C.1.0-beta8...

CVE-2008-1923

The CVE-2008-1923 issue affects the IAX2 channel driver (chan_iax2) in Asterisk 1.2.x (before r72630) and 1.4.x (before r65679). When configured to allow unauthenticated calls, it sends early audio to an unverified source IP address of a NEW message, enabling remote attackers to trigger a denial ...

CVE-2008-1289

CVE-2008-1289 describes memory corruption in Asterisk via RTP payload handling and SDP processing. Specifically, multiple buffer overflows allow remote attackers to write arbitrary memory: (1) by sending a large RTP payload number to affect ast_rtp_unset_m_type in main/rtp.c, and (2) by a large v...