CVE-2008-1333
published 2008-03-20CVE-2008-1333: Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that…
PriorityP432medium5.8CVSS 2.0
AVNACMAuNCNIPAP
EPSS
3.22%
86.7th percentile
Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call, or (2) the astman_append function.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| asterisk | open_source | — | — |
| asterisk | open_source | — | — |
| asterisk | open_source | — | — |
| asterisk | open_source | — | — |
| asterisk | open_source | — | — |
| debian | asterisk | < asterisk 1:1.4.18.1~dfsg-1 (bullseye) | asterisk 1:1.4.18.1~dfsg-1 (bullseye) |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P
osv5.8MEDIUM
vendor_debian5.8MEDIUM
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2008-1333: asterisk - Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 mig...
vendor_debian·2008·CVSS 5.8
CVE-2008-1333 [MEDIUM] CVE-2008-1333: asterisk - Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 mig...
Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call, or (2) the astman_append function.
Scope: local
bullseye: resolved (fixed in 1:1.4.18.1~dfsg-1)
sid: resolved (fixed in 1:1.4.18.1~dfsg-1)
Red Hat
asterisk: Format String Vulnerability in Logger and Manager (AST-2008-004)
vendor_redhat·CVSS 5.8
CVE-2008-1333 [MEDIUM] asterisk: Format String Vulnerability in Logger and Manager (AST-2008-004)
asterisk: Format String Vulnerability in Logger and Manager (AST-2008-004)
Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call, or (2) the astman_append function.
Red Hat
CVE-2008-5377: pstopdf in CUPS 1
vendor_redhat·CVSS 1.2
CVE-2008-5377 [LOW] CVE-2008-5377: pstopdf in CUPS 1
pstopdf in CUPS 1.3.8 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pstopdf.log temporary file, a different vulnerability than CVE-2001-1333.
Statement: Not vulnerable. This issue did not affect the versions of CUPS as shipped with Red Hat Enterprise Linux 3, 4, or 5.
Affected script is not part of the upstream CUPS distribution, but rather an addition used by Debian-based distributions (and possibly others).
CUPS packages as shipped in Red Hat Enterprise Linux 5 also provide pstopdf filter. However, that filter is different from the one used in Debian-based distributions, and is unaffected by this flaw.
Additionally, all filters used by CUPS on all versions of Red Hat Enterprise Linux are run under an unprivileged "lp" user, making the root privilege es
GHSA
GHSA-856p-vmg2-whf5: Format string vulnerability in Asterisk Open Source 1
ghsa_unreviewed·2022-05-01
CVE-2008-1333 [MEDIUM] CWE-134 GHSA-856p-vmg2-whf5: Format string vulnerability in Asterisk Open Source 1
Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call, or (2) the astman_append function.
OSV
CVE-2008-1333: Format string vulnerability in Asterisk Open Source 1
osv·2008-03-20·CVSS 5.8
CVE-2008-1333 [MEDIUM] CVE-2008-1333: Format string vulnerability in Asterisk Open Source 1
Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call, or (2) the astman_append function.
No detection rules found.
No public exploits indexed.
http://downloads.digium.com/pub/security/AST-2008-004.htmlhttp://secunia.com/advisories/29426http://secunia.com/advisories/29456http://securitytracker.com/id?1019630http://www.asterisk.org/node/48466http://www.debian.org/security/2008/dsa-1525http://www.securityfocus.com/archive/1/489823/100/0/threadedhttp://www.securityfocus.com/bid/28311http://www.vupen.com/english/advisories/2008/0928https://exchange.xforce.ibmcloud.com/vulnerabilities/41301http://downloads.digium.com/pub/security/AST-2008-004.htmlhttp://secunia.com/advisories/29426http://secunia.com/advisories/29456http://securitytracker.com/id?1019630http://www.asterisk.org/node/48466http://www.debian.org/security/2008/dsa-1525http://www.securityfocus.com/archive/1/489823/100/0/threadedhttp://www.securityfocus.com/bid/28311http://www.vupen.com/english/advisories/2008/0928https://exchange.xforce.ibmcloud.com/vulnerabilities/41301
2008-03-20
Published