National Cyber Awareness System

Vulnerability Summary for CVE-2008-2119

Overview

Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2008-1731

Hyperlink:http://www.vupen.com/english/advisories/2008/1731

External Source: SECTRACK

Name: 1020166

Hyperlink:http://www.securitytracker.com/id?1020166

External Source: BUGTRAQ

Name: 20080603 AST-2008-008: Remote Crash Vulnerability in SIP channel driver when run in pedantic mode

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/493020/100/0/threaded

External Source: CONFIRM

Name: http://svn.digium.com/view/asterisk?view=rev&revision=120109

Hyperlink:http://svn.digium.com/view/asterisk?view=rev&revision=120109

External Source: GENTOO

Name: GLSA-200905-01

Hyperlink:http://security.gentoo.org/glsa/glsa-200905-01.xml

External Source: SECUNIA

Name: 34982

Hyperlink:http://secunia.com/advisories/34982

External Source: CONFIRM

Name: http://downloads.digium.com/pub/security/AST-2008-008.html

Hyperlink:http://downloads.digium.com/pub/security/AST-2008-008.html

External Source: CONFIRM

Name: http://bugs.digium.com/view.php?id=12607

Hyperlink:http://bugs.digium.com/view.php?id=12607

External Source: XF

Name: asterisk-asturidecode-dos(42823)

Hyperlink:http://xforce.iss.net/xforce/xfdb/42823

External Source: MILW0RM

Name: 5749

Hyperlink:http://www.milw0rm.com/exploits/5749

External Source: SECUNIA

Name: 30517

Hyperlink:http://secunia.com/advisories/30517