CVE Vulnerabilities

CVE-2008-1897

Improper Authentication

Published: Apr 23, 2008 | Modified: Oct 11, 2018
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu

The IAX2 channel driver (chan_iax2) in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow unauthenticated calls, does not verify that an ACK response contains a call number matching the servers reply to a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed ACK response that does not complete a 3-way handshake. NOTE: this issue exists because of an incomplete fix for CVE-2008-1923.

Weakness

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Asterisk_appliance_developer_kit Asterisk 0.2 0.2
Asterisk_appliance_developer_kit Asterisk 0.3 0.3
Asterisk_appliance_developer_kit Asterisk 0.4 0.4
Asterisk_appliance_developer_kit Asterisk 0.5 0.5
Asterisk_appliance_developer_kit Asterisk 0.6 0.6
Asterisk_appliance_developer_kit Asterisk 0.6.0 0.6.0
Asterisk_appliance_developer_kit Asterisk 0.7 0.7
Asterisk_appliance_developer_kit Asterisk 0.8 0.8
Asterisk_business_edition Asterisk a a
Asterisk_business_edition Asterisk b.1.3.2 b.1.3.2
Asterisk_business_edition Asterisk b.1.3.3 b.1.3.3
Asterisk_business_edition Asterisk b.2.2.0 b.2.2.0
Asterisk_business_edition Asterisk b.2.2.1 b.2.2.1
Asterisk_business_edition Asterisk b.2.3.1 b.2.3.1
Asterisk_business_edition Asterisk b.2.3.2 b.2.3.2
Asterisk_business_edition Asterisk b.2.3.3 b.2.3.3
Asterisk_business_edition Asterisk b.2.3.4 b.2.3.4
Asterisk_business_edition Asterisk b.2.3.6 b.2.3.6
Asterisk_business_edition Asterisk b.2.5.0 b.2.5.0
Asterisk_business_edition Asterisk * b.2.5.1
Asterisk_business_edition Asterisk c.1.0 c.1.0
Asterisk_business_edition Asterisk c.1.0 c.1.0
Asterisk_business_edition Asterisk c.1.6 c.1.6
Asterisk_business_edition Asterisk c.1.6.1 c.1.6.1
Asterisk_business_edition Asterisk c.1.6.2 c.1.6.2
Asterisk_business_edition Asterisk * c1.8.0
Asterisknow Asterisk 1.0 1.0
Asterisknow Asterisk 1.0.1 1.0.1
Asterisknow Asterisk * 1.0.2
Open_source Asterisk 1.0 1.0
Open_source Asterisk 1.0 1.0
Open_source Asterisk 1.0 1.0
Open_source Asterisk 1.0.0 1.0.0
Open_source Asterisk 1.0.1 1.0.1
Open_source Asterisk 1.0.2 1.0.2
Open_source Asterisk 1.0.3 1.0.3
Open_source Asterisk 1.0.3.4 1.0.3.4
Open_source Asterisk 1.0.4 1.0.4
Open_source Asterisk 1.0.5 1.0.5
Open_source Asterisk 1.0.6 1.0.6
Open_source Asterisk 1.0.7 1.0.7
Open_source Asterisk 1.0.8 1.0.8
Open_source Asterisk 1.0.9 1.0.9
Open_source Asterisk 1.0.11 1.0.11
Open_source Asterisk 1.0.11 1.0.11
Open_source Asterisk 1.0.11.1 1.0.11.1
Open_source Asterisk 1.0.11.1 1.0.11.1
Open_source Asterisk 1.0.12 1.0.12
Open_source Asterisk 1.0.12 1.0.12
Open_source Asterisk 1.2.0 1.2.0
Open_source Asterisk 1.2.0 1.2.0
Open_source Asterisk 1.2.0 1.2.0
Open_source Asterisk 1.2.0 1.2.0
Open_source Asterisk 1.2.0 1.2.0
Open_source Asterisk 1.2.1 1.2.1
Open_source Asterisk 1.2.2 1.2.2
Open_source Asterisk 1.2.2 1.2.2
Open_source Asterisk 1.2.3 1.2.3
Open_source Asterisk 1.2.3 1.2.3
Open_source Asterisk 1.2.4 1.2.4
Open_source Asterisk 1.2.4 1.2.4
Open_source Asterisk 1.2.5 1.2.5
Open_source Asterisk 1.2.5 1.2.5
Open_source Asterisk 1.2.6 1.2.6
Open_source Asterisk 1.2.6 1.2.6
Open_source Asterisk 1.2.7 1.2.7
Open_source Asterisk 1.2.7 1.2.7
Open_source Asterisk 1.2.7.1 1.2.7.1
Open_source Asterisk 1.2.7.1 1.2.7.1
Open_source Asterisk 1.2.8 1.2.8
Open_source Asterisk 1.2.8 1.2.8
Open_source Asterisk 1.2.9 1.2.9
Open_source Asterisk 1.2.9.1 1.2.9.1
Open_source Asterisk 1.2.9.1 1.2.9.1
Open_source Asterisk 1.2.10 1.2.10
Open_source Asterisk 1.2.10 1.2.10
Open_source Asterisk 1.2.11 1.2.11
Open_source Asterisk 1.2.11 1.2.11
Open_source Asterisk 1.2.12 1.2.12
Open_source Asterisk 1.2.12 1.2.12
Open_source Asterisk 1.2.12.1 1.2.12.1
Open_source Asterisk 1.2.12.1 1.2.12.1
Open_source Asterisk 1.2.13 1.2.13
Open_source Asterisk 1.2.13 1.2.13
Open_source Asterisk 1.2.14 1.2.14
Open_source Asterisk 1.2.14 1.2.14
Open_source Asterisk 1.2.15 1.2.15
Open_source Asterisk 1.2.15 1.2.15
Open_source Asterisk 1.2.16 1.2.16
Open_source Asterisk 1.2.16 1.2.16
Open_source Asterisk 1.2.17 1.2.17
Open_source Asterisk 1.2.17 1.2.17
Open_source Asterisk 1.2.18 1.2.18
Open_source Asterisk 1.2.18 1.2.18
Open_source Asterisk 1.2.19 1.2.19
Open_source Asterisk 1.2.19 1.2.19
Open_source Asterisk 1.2.20 1.2.20
Open_source Asterisk 1.2.20 1.2.20
Open_source Asterisk 1.2.21 1.2.21
Open_source Asterisk 1.2.21 1.2.21
Open_source Asterisk 1.2.21.1 1.2.21.1
Open_source Asterisk 1.2.21.1 1.2.21.1
Open_source Asterisk 1.2.22 1.2.22
Open_source Asterisk 1.2.22 1.2.22
Open_source Asterisk 1.2.23 1.2.23
Open_source Asterisk 1.2.23 1.2.23
Open_source Asterisk 1.2.24 1.2.24
Open_source Asterisk 1.2.24 1.2.24
Open_source Asterisk 1.2.25 1.2.25
Open_source Asterisk 1.2.25 1.2.25
Open_source Asterisk 1.2.26 1.2.26
Open_source Asterisk 1.2.26 1.2.26
Open_source Asterisk 1.2.26.1 1.2.26.1
Open_source Asterisk 1.2.26.1 1.2.26.1
Open_source Asterisk 1.2.26.2 1.2.26.2
Open_source Asterisk 1.2.26.2 1.2.26.2
Open_source Asterisk * 1.2.27
Open_source Asterisk 1.4.0 1.4.0
Open_source Asterisk 1.4.0 1.4.0
Open_source Asterisk 1.4.0 1.4.0
Open_source Asterisk 1.4.0 1.4.0
Open_source Asterisk 1.4.1 1.4.1
Open_source Asterisk 1.4.10 1.4.10
Open_source Asterisk 1.4.10.1 1.4.10.1
Open_source Asterisk 1.4.11 1.4.11
Open_source Asterisk 1.4.12 1.4.12
Open_source Asterisk 1.4.12.1 1.4.12.1
Open_source Asterisk 1.4.13 1.4.13
Open_source Asterisk 1.4.14 1.4.14
Open_source Asterisk 1.4.15 1.4.15
Open_source Asterisk 1.4.16 1.4.16
Open_source Asterisk 1.4.16.1 1.4.16.1
Open_source Asterisk 1.4.16.2 1.4.16.2
Open_source Asterisk 1.4.17 1.4.17
Open_source Asterisk 1.4.18 1.4.18
Open_source Asterisk 1.4.18.1 1.4.18.1
Open_source Asterisk * 1.4.19
S800i Asterisk 1.0 1.0
S800i Asterisk 1.0.1 1.0.1
S800i Asterisk 1.0.2 1.0.2
S800i Asterisk 1.0.3 1.0.3
S800i Asterisk 1.0.3.3 1.0.3.3
S800i Asterisk 1.1.0 1.1.0
S800i Asterisk 1.1.0.1 1.1.0.1
S800i Asterisk * 1.1.0.2
Asterisk Ubuntu dapper *
Asterisk Ubuntu feisty *
Asterisk Ubuntu gutsy *
Asterisk Ubuntu hardy *
Asterisk Ubuntu upstream *

Potential Mitigations

References