Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2008-1333 | First vendor Publication | 2008-03-19 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5.8 | Attack Range | Network |
| Cvss Impact Score | 4.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call, or (2) the astman_append function. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1333 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-134 | Uncontrolled Format String (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:17968 | |||
| Oval ID: | oval:org.mitre.oval:def:17968 | ||
| Title: | DSA-1525-1 asterisk | ||
| Description: | Several remote vulnerabilities have been discovered in Asterisk, a free software PBX and telephony toolkit. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1525-1 CVE-2007-6430 CVE-2008-1332 CVE-2008-1333 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | asterisk |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:8002 | |||
| Oval ID: | oval:org.mitre.oval:def:8002 | ||
| Title: | DSA-1525 asterisk -- several vulnerabilities | ||
| Description: | Several remote vulnerabilities have been discovered in Asterisk, a free software PBX and telephony toolkit. The Common Vulnerabilities and Exposures project identifies the following problems: Tilghman Lesher discovered that database-based registrations are insufficiently validated. This only affects setups, which are configured to run without a password and only host-based authentication. Jason Parker discovered that insufficient validation of From: headers inside the SIP channel driver may lead to authentication bypass and the potential external initiation of calls. This update also fixes a format string vulnerability, which can only be triggered through configuration files under control of the local administrator. In later releases of Asterisk this issue is remotely exploitable and tracked as CVE-2008-1333. The status of the old stable distribution (sarge) is currently being investigated. If affected, an update will be released through security.debian.org. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1525 CVE-2007-6430 CVE-2008-1332 CVE-2008-1333 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | asterisk |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 5 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-03-27 | Name : Debian Security Advisory DSA 1525-1 (asterisk) File : nvt/deb_1525_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 43414 | Asterisk ast_verbose Logging API Manager command Format String |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2008-03-21 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1525.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:14:47 |
|
| 2024-11-28 12:15:12 |
|
| 2021-05-04 12:07:18 |
|
| 2021-04-22 01:07:42 |
|
| 2020-05-23 00:21:26 |
|
| 2018-10-12 00:20:16 |
|
| 2017-08-08 09:23:57 |
|
| 2016-04-26 17:13:44 |
|
| 2014-02-17 10:44:15 |
|
| 2013-05-11 00:12:32 |
|
