Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2008-1289 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Asterisk

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer8 documents7 sources

Severity

7.5HIGHNVD

EPSS

25.0%

top 3.82%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Asterisk Appliance Developer KIT Debian Asterisk Asterisk Business Edition +3 more

Timeline

PublishedMar 24

Latest updateMay 1

Description

Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit before 1.4 revision 109386, and s800i 1.1.x before 1.1.0.2 allow remote attackers to (1) write a zero to an arbitrary memory location via a large RTP payload number, related to the ast_rtp_unset_m_type function in main/rtp.c; or (2) write certain integers to an arbitrary memory …

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages7 packages

▶NVDasterisk/open_source1.4.18+2

▶Debianasterisk/asterisk_appliance_developer_kit< 1:1.4.18.1~dfsg-1

▶NVDasterisk/asterisk_business_editionc.1.0-beta8+1

▶NVDasterisk/asterisk_appliance_developer_kit1.4

▶NVDasterisk/s800i1.1.0.1

🔴Vulnerability Details

GHSA

GHSA-xjqv-ch5c-vc5h: Multiple buffer overflows in Asterisk Open Source 1↗2022-05-01

▶

OSV

CVE-2008-1289: Multiple buffer overflows in Asterisk Open Source 1↗2008-03-24

▶

💥Exploits & PoCs

Exploit-DB

Asterisk 1.4.x - RTP Codec Payload Handling Multiple Buffer Overflow Vulnerabilities↗2008-03-18

▶

📋Vendor Advisories

Red Hat

mysql: incomplete upstream fix for CVE-2008-2079↗2008-07-03

▶

Debian

CVE-2008-1289: asterisk - Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4....↗2008

▶

Red Hat

asterisk: Two buffer overflows in RTP Codec Payload Handling (AST-2008-002)↗

▶

💬Community

Bugzilla

CVE-2008-1289 asterisk: Two buffer overflows in RTP Codec Payload Handling (AST-2008-002)↗2008-03-19

▶