CVE-2008-2119
published 2008-06-04CVE-2008-2119: Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is…
PriorityP424medium4.3CVSS 2.0
AVNACMAuNCNINAP
EXPLOIT
EPSS
7.27%
93.6th percentile
Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer.
Affected
55 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| asterisk | asterisk_business_edition | <= b2.5.2 | — |
| asterisk | asterisk_business_edition | — | — |
| asterisk | asterisk_business_edition | — | — |
| asterisk | asterisk_business_edition | — | — |
| asterisk | asterisk_business_edition | — | — |
| asterisk | asterisk_business_edition | — | — |
| asterisk | asterisk_business_edition | — | — |
| asterisk | asterisk_business_edition | — | — |
| asterisk | asterisk_business_edition | — | — |
| asterisk | asterisk_business_edition | — | — |
| asterisk | asterisk_business_edition | — | — |
| asterisk | asterisk_business_edition | >= 0 < 1.4 | 1.4 |
| asterisk | open_source | <= 1.2.28 | — |
| asterisk | open_source | — | — |
| asterisk | open_source | — | — |
| asterisk | open_source | — | — |
| asterisk | open_source | — | — |
| asterisk | open_source | — | — |
| asterisk | open_source | — | — |
| asterisk | open_source | — | — |
| asterisk | open_source | — | — |
| asterisk | open_source | — | — |
| asterisk | open_source | — | — |
| asterisk | open_source | — | — |
| asterisk | open_source | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv4.3MEDIUM
vendor_debian4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rh4w-35r5-ffvh: Asterisk Open Source 1
ghsa_unreviewed·2022-05-01
CVE-2008-2119 [MEDIUM] CWE-20 GHSA-rh4w-35r5-ffvh: Asterisk Open Source 1
Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer.
OSV
CVE-2008-2119: Asterisk Open Source 1
osv·2008-06-04·CVSS 4.3
CVE-2008-2119 [MEDIUM] CVE-2008-2119: Asterisk Open Source 1
Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer.
Debian
CVE-2008-2119: asterisk - Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x an...
vendor_debian·2008·CVSS 4.3
CVE-2008-2119 [MEDIUM] CVE-2008-2119: asterisk - Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x an...
Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer.
Scope: local
bullseye: resolved (fixed in 1.4)
sid: resolved (fixed in 1.4)
No detection rules found.
No writeups or analysis indexed.
http://bugs.digium.com/view.php?id=12607http://downloads.digium.com/pub/security/AST-2008-008.htmlhttp://secunia.com/advisories/30517http://secunia.com/advisories/34982http://security.gentoo.org/glsa/glsa-200905-01.xmlhttp://svn.digium.com/view/asterisk?view=rev&revision=120109http://www.securityfocus.com/archive/1/493020/100/0/threadedhttp://www.securitytracker.com/id?1020166http://www.vupen.com/english/advisories/2008/1731https://exchange.xforce.ibmcloud.com/vulnerabilities/42823https://www.exploit-db.com/exploits/5749http://bugs.digium.com/view.php?id=12607http://downloads.digium.com/pub/security/AST-2008-008.htmlhttp://secunia.com/advisories/30517http://secunia.com/advisories/34982http://security.gentoo.org/glsa/glsa-200905-01.xmlhttp://svn.digium.com/view/asterisk?view=rev&revision=120109http://www.securityfocus.com/archive/1/493020/100/0/threadedhttp://www.securitytracker.com/id?1020166http://www.vupen.com/english/advisories/2008/1731https://exchange.xforce.ibmcloud.com/vulnerabilities/42823https://www.exploit-db.com/exploits/5749
2008-06-04
Published