Asterisk Pedantic Mode 'From' Header Processing Remote Denial of Service Vulnerability
BID:29516
Info
Asterisk Pedantic Mode 'From' Header Processing Remote Denial of Service Vulnerability
| Bugtraq ID: | 29516 |
| Class: | Design Error |
| CVE: |
CVE-2008-2119 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 03 2008 12:00AM |
| Updated: | Jun 03 2008 12:00AM |
| Credit: | Hooi Ng |
| Vulnerable: |
Gentoo Linux Asterisk Asterisk Business Edition B.2.5.2 Asterisk Asterisk Business Edition B.2.5.1 Asterisk Asterisk Business Edition B.2.3.6 Asterisk Asterisk Business Edition B.2.3.4 Asterisk Asterisk Business Edition B.2.3.3 Asterisk Asterisk Business Edition B.2.3.2 Asterisk Asterisk Business Edition B.2.3.1 Asterisk Asterisk Business Edition B.2.2.1 Asterisk Asterisk Business Edition B.2.2.1 Asterisk Asterisk Business Edition B.2.2.0 Asterisk Asterisk Business Edition B.2.2.0 Asterisk Asterisk Business Edition B.1.3.3 Asterisk Asterisk Business Edition B.1.3.2 Asterisk Asterisk Business Edition B Asterisk Asterisk Business Edition A Asterisk Asterisk 1.2.28 Asterisk Asterisk 1.2.27 Asterisk Asterisk 1.2.27 Asterisk Asterisk 1.2.26 Asterisk Asterisk 1.2.25 Asterisk Asterisk 1.2.24 Asterisk Asterisk 1.2.23 Asterisk Asterisk 1.2.22 Asterisk Asterisk 1.2.21 Asterisk Asterisk 1.2.19 Asterisk Asterisk 1.2.18 Asterisk Asterisk 1.2.17 Asterisk Asterisk 1.2.16 Asterisk Asterisk 1.2.15 Asterisk Asterisk 1.2.14 Asterisk Asterisk 1.2.13 Asterisk Asterisk 1.2.11 Asterisk Asterisk 1.2.11 Asterisk Asterisk 1.2.10 Asterisk Asterisk 1.2.9 Asterisk Asterisk 1.2.8 Asterisk Asterisk 1.2.7 Asterisk Asterisk 1.2.6 Asterisk Asterisk 1.2.5 Asterisk Asterisk 1.2 .0-beta2 Asterisk Asterisk 1.2 .0-beta1 Asterisk Asterisk 1.0.12 Asterisk Asterisk 1.0.11 Asterisk Asterisk 1.0.10 Asterisk Asterisk 1.0.9 Asterisk Asterisk 1.0.8 Asterisk Asterisk 1.0.7 Asterisk Asterisk 1.0.6 Asterisk Asterisk 1.0 Asterisk Asterisk 1.0.3.4 |
| Not Vulnerable: |
Asterisk Asterisk Business Edition B.2.5.3 Asterisk Asterisk 1.2.29 |
Discussion
Asterisk Pedantic Mode 'From' Header Processing Remote Denial of Service Vulnerability
Asterisk is prone to a remote denial-of-service vulnerability because it fails to adequately validate the 'From' header value in pedantic mode.
Successful exploits can crash the SIP channel driver, resulting in denial-of-service conditions for legitimate users.
Asterisk is prone to a remote denial-of-service vulnerability because it fails to adequately validate the 'From' header value in pedantic mode.
Successful exploits can crash the SIP channel driver, resulting in denial-of-service conditions for legitimate users.
Exploit / POC
Asterisk Pedantic Mode 'From' Header Processing Remote Denial of Service Vulnerability
Attackers can exploit this issue by using readily available networking utilities.
The following exploit is available:
Attackers can exploit this issue by using readily available networking utilities.
The following exploit is available:
Solution / Fix
Asterisk Pedantic Mode 'From' Header Processing Remote Denial of Service Vulnerability
Solution:
The vendor has released an advisory along with updates. Please see the references for more information.
Solution:
The vendor has released an advisory along with updates. Please see the references for more information.
References
Asterisk Pedantic Mode 'From' Header Processing Remote Denial of Service Vulnerability
References:
References:
- Asterisk Homepage (Asterisk)
- AST-2008-008: Remote Crash Vulnerability in SIP channel driver when run in pedan ("Asterisk Security Team"
- AST-2008-008 Remote Crash Vulnerability in SIP channel driver when run in pedan (Asterisk)