NetSight
IP …
high7.8

CVE-2009-2346

The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Busin…

Impact

The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and C.3.x before C.3.1.1; and s800i 1.3.x before 1.3.0.3 allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many IAX2 message exchanges, a related issue to CVE-2008-3263.

Affected products

VendorProductAffected versions
AsteriskAsterisk
Versions b.1.3.2, b.1.3.3, b.2.2.0, b.2.2.1, b.2.3.1, b.2.3.2
AsteriskOpen Source
Versions 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5
AsteriskOpensource
Versions 1.4.23.2, 1.4.24, 1.4.24.1, 1.4.26, 1.4.26.1
SangomaAsterisk
Versions 1.6.1, 1.6.1.4
AsteriskAppliance S800i
Versions 1.3, 1.3.0.2

Weakness classification

CWE-119

References