NetSight
IP …
medium4.3Public exploit code

CVE-2008-2119

Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enab…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer.

Affected products

VendorProductAffected versions
AsteriskAsterisk Business Edition
through b2.5.2
Versions b.1.3.2, b.1.3.3, b.2.2.0, b.2.2.1, b.2.3.1
AsteriskOpen Source
through 1.2.28
Versions 1.0, 1.0.0, 1.0.1, 1.0.2, 1.0.3

Weakness classification

CWE-20

References