CVE-2008-3263
published 2008-07-22CVE-2008-3263: The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4…
PriorityP348high7.8CVSS 2.0
AVNACLAuNCNINAC
EXPLOIT
EPSS
28.00%
97.9th percentile
The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers to cause a denial of service (call-number exhaustion and CPU consumption) by quickly sending a large number of IAX2 (IAX) POKE requests.
Affected
231 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| asterisk | appliance_s800i | — | — |
| asterisk | appliance_s800i | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
| asterisk | asterisk | — | — |
CVSS provenance
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qm3m-5rgr-2hq8: The IAX2 protocol implementation in Asterisk Open Source 1
ghsa_unreviewed·2022-05-02·CVSS 7.8
CVE-2009-2346 [HIGH] CWE-119 GHSA-qm3m-5rgr-2hq8: The IAX2 protocol implementation in Asterisk Open Source 1
The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and C.3.x before C.3.1.1; and s800i 1.3.x before 1.3.0.3 allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many IAX2 message exchanges, a related issue to CVE-2008-3263.
GHSA
GHSA-w3xv-vhr5-qfqw: The IAX2 protocol implementation in Asterisk Open Source 1
ghsa_unreviewed·2022-05-01
CVE-2008-3263 [HIGH] GHSA-w3xv-vhr5-qfqw: The IAX2 protocol implementation in Asterisk Open Source 1
The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers to cause a denial of service (call-number exhaustion and CPU consumption) by quickly sending a large number of IAX2 (IAX) POKE requests.
OSV
CVE-2009-2346: The IAX2 protocol implementation in Asterisk Open Source 1
osv·2009-09-08·CVSS 7.8
CVE-2009-2346 [HIGH] CVE-2009-2346: The IAX2 protocol implementation in Asterisk Open Source 1
The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and C.3.x before C.3.1.1; and s800i 1.3.x before 1.3.0.3 allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many IAX2 message exchanges, a related issue to CVE-2008-3263.
OSV
CVE-2008-3263: The IAX2 protocol implementation in Asterisk Open Source 1
osv·2008-07-22·CVSS 7.8
CVE-2008-3263 [HIGH] CVE-2008-3263: The IAX2 protocol implementation in Asterisk Open Source 1
The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers to cause a denial of service (call-number exhaustion and CPU consumption) by quickly sending a large number of IAX2 (IAX) POKE requests.
Red Hat
asterisk: IAX2 DoS vulnerability (AST-2009-006)
vendor_redhat·2009-09-03·CVSS 7.8
CVE-2009-2346 [HIGH] asterisk: IAX2 DoS vulnerability (AST-2009-006)
asterisk: IAX2 DoS vulnerability (AST-2009-006)
The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and C.3.x before C.3.1.1; and s800i 1.3.x before 1.3.0.3 allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many IAX2 message exchanges, a related issue to CVE-2008-3263.
Debian
CVE-2009-2346: asterisk - The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1....
vendor_debian·2009·CVSS 7.8
CVE-2009-2346 [HIGH] CVE-2009-2346: asterisk - The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1....
The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and C.3.x before C.3.1.1; and s800i 1.3.x before 1.3.0.3 allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many IAX2 message exchanges, a related issue to CVE-2008-3263.
Scope: local
bullseye: resolved (fixed in 1:1.6.2.0~dfsg~beta3-1)
sid: resolved (fixed in 1:1.6.2.0~dfsg~beta3-1)
Debian
CVE-2008-3263: asterisk - The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2...
vendor_debian·2008·CVSS 7.8
CVE-2008-3263 [HIGH] CVE-2008-3263: asterisk - The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2...
The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers to cause a denial of service (call-number exhaustion and CPU consumption) by quickly sending a large number of IAX2 (IAX) POKE requests.
Scope: local
bullseye: resolved (fixed in 1:1.4.21.2~dfsg-1)
sid: resolved (fixed in 1:1.4.21.2~dfsg-1)
No detection rules found.
http://downloads.digium.com/pub/security/AST-2008-010.htmlhttp://downloads.securityfocus.com/vulnerabilities/exploits/30321.plhttp://secunia.com/advisories/31178http://secunia.com/advisories/31194http://secunia.com/advisories/34982http://security.gentoo.org/glsa/glsa-200905-01.xmlhttp://www.securityfocus.com/archive/1/494675/100/0/threadedhttp://www.securityfocus.com/bid/30321http://www.securitytracker.com/id?1020535http://www.vupen.com/english/advisories/2008/2168/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/43942https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00839.htmlhttp://downloads.digium.com/pub/security/AST-2008-010.htmlhttp://downloads.securityfocus.com/vulnerabilities/exploits/30321.plhttp://secunia.com/advisories/31178http://secunia.com/advisories/31194http://secunia.com/advisories/34982http://security.gentoo.org/glsa/glsa-200905-01.xmlhttp://www.securityfocus.com/archive/1/494675/100/0/threadedhttp://www.securityfocus.com/bid/30321http://www.securitytracker.com/id?1020535http://www.vupen.com/english/advisories/2008/2168/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/43942https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00839.html
2008-07-22
Published