NetSight
IP …
high7.1

CVE-2008-1923

The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends …

Impact

The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "early audio" to an unverified source IP address of a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed NEW message.

Affected products

VendorProductAffected versions
AsteriskAsterisk Appliance Developer Kit
All versions
AsteriskAsterisk Business Edition
through b2.5.1
through c1.8.0
Versions a, b.1.3.2, b.1.3.3, b.2.2.0
AsteriskAsterisknow
through 1.0.2
Versions 1.0, 1.0.1
AsteriskOpen Source
Versions 1.0, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4
AsteriskS800i
through 1.1.0.2
Versions 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.3.3

Weakness classification

CWE-16

References