Unscored severity · published Jun 4, 2008
CVE-2008-2119
Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote…
–
CVSS
7.3%
EPSS
No
On KEV
Description
Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.3% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Asterisk Business Edition · Asterisk
through b2.5.2; b.1.3.2; b.1.3.3; b.2.2.0; b.2.2.1; b.2.3.1; +5 more · source: NVD
OS
Open Source · Asterisk
through 1.2.28; 1.0; 1.0.0; 1.0.1; 1.0.2; 1.0.3; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-2119
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-2119
bugs.digium.com
http://bugs.digium.com/view.php?id=12607
downloads.digium.com
http://downloads.digium.com/pub/security/AST-2008-008.html
secunia.com
http://secunia.com/advisories/30517
secunia.com
http://secunia.com/advisories/34982
security.gentoo.org
http://security.gentoo.org/glsa/glsa-200905-01.xml
svn.digium.com
http://svn.digium.com/view/asterisk?view=rev&revision=120109
More from Asterisk Business Edition
–
CVE-2009-0041
IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and…
–
CVE-2008-5558
Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of…
–
CVE-2008-3264
The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x…
–
CVE-2008-1897
The IAX2 channel driver (chan_iax2) in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before…
–
CVE-2008-1923
The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "early audio" to an…