NetSight
IP …
medium5.0Public exploit code

CVE-2008-0095

The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit befo…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit before Asterisk 1.4 revision 95946, and Appliance s800i 1.0.x before 1.0.3.4 allows remote attackers to cause a denial of service (daemon crash) via a BYE message with an Also (Also transfer) header, which triggers a NULL pointer dereference.

Affected products

VendorProductAffected versions
AsteriskAsterisk Appliance Developer Kit
through 1.4_revision_95945
AsteriskAsterisk Business Edition
through c.1.0beta7
AsteriskAsterisknow
through beta_6
AsteriskOpen Source
through 1.4.16
AsteriskS800i
through 1.0.3.3

Weakness classification

CWE-399

References