Executive Summary

Informations
NameCVE-2008-1923First vendor Publication2008-04-23
VendorCveLast vendor Modification2017-08-07

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:C)
Cvss Base Score7.1Attack RangeNetwork
Cvss Impact Score6.9Attack ComplexityMedium
Cvss Expoit Score8.6AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "early audio" to an unverified source IP address of a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed NEW message.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1923

CWE : Common Weakness Enumeration

%idName
100 %CWE-16Configuration

CPE : Common Platform Enumeration

TypeDescriptionCount
Application1
Application25
Application6
Application109
Application8

Open Source Vulnerability Database (OSVDB)

idDescription
44648Asterisk IAX2 Channel Driver (chan_iax2) Spoofed NEW Message Remote DoS

Nessus® Vulnerability Scanner

DateDescription
2008-05-06Name : The remote VoIP service can be abused to conduct an amplification attack agai...
File : asterisk_iax2_spoofed_handshake.nasl - Type : ACT_ATTACK

Sources (Detail)

SourceUrl
CONFIRM http://bugs.digium.com/view.php?id=10078
http://downloads.digium.com/pub/security/AST-2008-006.html
MISC http://www.altsci.com/concepts/page.php?s=asteri&p=1
XF https://exchange.xforce.ibmcloud.com/vulnerabilities/42049

Alert History

If you want to see full details history, please login or register.
0
1
2
3
DateInformations
2017-08-08 09:24:02
  • Multiple Updates
2016-04-26 17:20:22
  • Multiple Updates
2014-02-17 10:44:45
  • Multiple Updates
2013-05-11 00:15:50
  • Multiple Updates