CVE-2008-2119

CVSS V2 Medium 4.3 CVSS V3 None
Description
Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer.
Overview
  • CVE ID
  • CVE-2008-2119
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2008-06-04T19:32:00
  • Last Modified Date
  • 2018-10-11T20:39:33
Weakness Enumerations
CWE URL
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:asterisk:asterisk_business_edition:*:*:*:*:*:*:*:* 1 OR b2.5.2
cpe:2.3:a:asterisk:asterisk_business_edition:b.1.3.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:asterisk_business_edition:b.1.3.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:asterisk_business_edition:b.2.2.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:asterisk_business_edition:b.2.2.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:asterisk_business_edition:b.2.3.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:asterisk_business_edition:b.2.3.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:asterisk_business_edition:b.2.3.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:asterisk_business_edition:b.2.3.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:asterisk_business_edition:b.2.5.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:asterisk_business_edition:b2.5.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:*:*:*:*:*:*:*:* 1 OR 1.2.28
cpe:2.3:a:asterisk:open_source:1.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.0.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.0.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.0.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.0.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.0.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.0.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.0.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.0.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.0.11.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.0.12:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.0beta1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.0beta2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.12:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.12.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.13:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.14:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.15:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.16:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.17:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.18:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.19:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.20:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.21:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.21.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.22:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.23:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.24:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.25:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.26:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.26.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.26.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:asterisk:open_source:1.2.27:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:N/I:N/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • NONE
  • Availability Impact
  • PARTIAL
  • Base Score
  • 4.3
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://bugs.digium.com/view.php?id=12607
http://downloads.digium.com/pub/security/AST-2008-008.html
http://svn.digium.com/view/asterisk?view=rev&revision=120109
http://secunia.com/advisories/30517
http://www.securitytracker.com/id?1020166
http://security.gentoo.org/glsa/glsa-200905-01.xml
http://secunia.com/advisories/34982
http://www.vupen.com/english/advisories/2008/1731
https://exchange.xforce.ibmcloud.com/vulnerabilities/42823
https://www.exploit-db.com/exploits/5749
http://www.securityfocus.com/archive/1/493020/100/0/threaded
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2008-2119
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2119
History
Created Old Value New Value Data Type Notes
2022-05-10 18:28:59 Added to TrackCVE