CVEvulnerability

CVE-2008-1897

4.3 MEDIUM Published 2008-04-23 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-04-23
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-287

Description

The IAX2 channel driver (chan_iax2) in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow unauthenticated calls, does not verify that an ACK response contains a call number matching the server's reply to a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed ACK response that does not complete a 3-way handshake. NOTE: this issue exists because of an incomplete fix for CVE-2008-1923.

Affected configurations

• asterisk asterisk appliance developer kit 0.2 • asterisk asterisk appliance developer kit 0.3 • asterisk asterisk appliance developer kit 0.4 • asterisk asterisk appliance developer kit 0.5 • asterisk asterisk appliance developer kit 0.6 • asterisk asterisk appliance developer kit 0.6.0 • asterisk asterisk appliance developer kit 0.7 • asterisk asterisk appliance developer kit 0.8 • asterisk asterisk business edition (<= b.2.5.1) • asterisk asterisk business edition (<= c1.8.0) • asterisk asterisk business edition a • asterisk asterisk business edition b.1.3.2 • asterisk asterisk business edition b.1.3.3 • asterisk asterisk business edition b.2.2.0 • asterisk asterisk business edition b.2.2.1 • asterisk asterisk business edition b.2.3.1 • asterisk asterisk business edition b.2.3.2 • asterisk asterisk business edition b.2.3.3 • asterisk asterisk business edition b.2.3.4 • asterisk asterisk business edition b.2.3.6 • asterisk asterisk business edition b.2.5.0 • asterisk asterisk business edition c.1.0 • asterisk asterisk business edition c.1.6 • asterisk asterisk business edition c.1.6.1 • asterisk asterisk business edition c.1.6.2 • asterisk asterisknow (<= 1.0.2) • asterisk asterisknow 1.0 • asterisk asterisknow 1.0.1 • asterisk open source (<= 1.2.27) • asterisk open source (<= 1.4.19) • asterisk open source 1.0 • asterisk open source 1.0.0 • asterisk open source 1.0.1 • asterisk open source 1.0.2 • asterisk open source 1.0.3 • asterisk open source 1.0.3.4 • asterisk open source 1.0.4 • asterisk open source 1.0.5 • asterisk open source 1.0.6 • asterisk open source 1.0.7 • asterisk open source 1.0.8 • asterisk open source 1.0.9 • asterisk open source 1.0.11 • asterisk open source 1.0.11.1 • asterisk open source 1.0.12 • asterisk open source 1.2.0 • asterisk open source 1.2.1 • asterisk open source 1.2.2 • asterisk open source 1.2.3 • asterisk open source 1.2.4 • asterisk open source 1.2.5 • asterisk open source 1.2.6 • asterisk open source 1.2.7 • asterisk open source 1.2.7.1 • asterisk open source 1.2.8 • asterisk open source 1.2.9 • asterisk open source 1.2.9.1 • asterisk open source 1.2.10 • asterisk open source 1.2.11 • asterisk open source 1.2.12 … and 42 more

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References