CVEvulnerability
CVE-2008-1390
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2008-03-24
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-255
Description
The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.
Affected configurations
• asterisk asterisk 1.4.1
• asterisk asterisk 1.4.2
• asterisk asterisk 1.4.3
• asterisk asterisk 1.4.4
• asterisk asterisk 1.4.5
• asterisk asterisk 1.4.6
• asterisk asterisk 1.4.7
• asterisk asterisk 1.4.8
• asterisk asterisk 1.4.9
• asterisk asterisk 1.4.10
• asterisk asterisk 1.4.11
• asterisk asterisk 1.4.12
• asterisk asterisk 1.4.13
• asterisk asterisk 1.4.14
• asterisk asterisk 1.4.15
• asterisk asterisk 1.4.16
• asterisk asterisk 1.4.17
• asterisk asterisk 1.4.18.1
• asterisk asterisk 1.4 beta
• asterisk asterisk 1.4 revision 95946
• asterisk asterisk 1.6
• asterisk asterisk appliance developer kit 0.2
• asterisk asterisk appliance developer kit 0.3
• asterisk asterisk appliance developer kit 0.4
• asterisk asterisk appliance developer kit 0.5
• asterisk asterisk appliance developer kit 0.6
• asterisk asterisk appliance developer kit 0.7
• asterisk asterisk appliance developer kit 0.8
• asterisk asterisk appliance developer kit 1.4
• asterisk asterisk business edition c.1.0-beta7
• asterisk asterisk business edition c.1.0-beta8
• asterisk asterisknow 1.0
• asterisk asterisknow beta 5
• asterisk asterisknow beta 6
• asterisk asterisknow beta 7
• asterisk s800i 1.0
• asterisk s800i 1.0.1
• asterisk s800i 1.0.2
• asterisk s800i 1.0.3
• asterisk s800i 1.1.0
Related
Weakness · not in database (1)
References
- http://downloads.digium.com/pub/security/AST-2008-005.html downloads.digium.com
- http://secunia.com/advisories/29449 Vendor Advisory
- http://secunia.com/advisories/29470 secunia.com
- http://securityreason.com/securityalert/3764 securityreason.com
- http://www.securityfocus.com/archive/1/489819/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/28316 www.securityfocus.com
- http://www.securitytracker.com/id?1019679 www.securitytracker.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41304 exchange.xforce.ibmcloud.com
- https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00438.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00514.html www.redhat.com
- http://downloads.digium.com/pub/security/AST-2008-005.html downloads.digium.com
- http://secunia.com/advisories/29449 Vendor Advisory
- http://secunia.com/advisories/29470 secunia.com
- http://securityreason.com/securityalert/3764 securityreason.com
- http://www.securityfocus.com/archive/1/489819/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/28316 www.securityfocus.com
- http://www.securitytracker.com/id?1019679 www.securitytracker.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41304 exchange.xforce.ibmcloud.com
- https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00438.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00514.html www.redhat.com