NetSight
IP …
high7.5Public exploit code

CVE-2008-1289

Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit before 1.4 revision 109386, and s800i 1.1.x before 1.1.0.2 allow remote attackers to (1) write a zero to an arbitrary memory location via a large RTP payload number, related to the ast_rtp_unset_m_type function in main/rtp.c; or (2) write certain integers to an arbitrary memory location via a large number of RTP payloads, related to the process_sdp function in channels/chan_sip.c.

Affected products

VendorProductAffected versions
AsteriskAsterisk Appliance Developer Kit
Version 1.4
AsteriskAsterisk Business Edition
through c.1.0-beta8
through c.1.0beta7
AsteriskAsterisknow
through 1.0.1
AsteriskOpen Source
through 1.4.18
through 1.4.19
through 1.6.0_beta5
AsteriskS800i
through 1.1.0.1

Weakness classification

CWE-119

References