SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (VoIP)  >   Asterisk Vendors:   Digium (Linux Support Services)
Asterisk IAX2 Poke Packet Processing Lets Remote Users Deny Service
SecurityTracker Alert ID:  1020535
SecurityTracker URL:  http://securitytracker.com/id/1020535
CVE Reference:   CVE-2008-3263   (Links to External Site)
Date:  Jul 23 2008
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.2 prior to 1.2.30, 1.4 prior to 1.4.21.2
Description:   A vulnerability was reported in Asterisk. A remote user can cause denial of service conditions.

A remote user can send a flood of specially crafted IAX2 POKE requests to consume all available IAX2 protocol call numbers on the target system, preventing other IAX2 calls from getting through.

The vendor was notified on July 18, 2008.

A demonstration exploit is available at:

http://downloads.securityfocus.com/vulnerabilities/exploits/30321.pl

Jeremy McNamara reported this vulnerability.

Impact:   A remote user can consume all available IAX2 call numbers on the target system, preventing additional calls.
Solution:   The vendor has issued a fixed version (1.2.30, 1.4.21.2).

The vendor's advisory is available at:

http://downloads.digium.com/pub/security/AST-2008-010.html

Vendor URL:  downloads.digium.com/pub/security/AST-2008-010.html (Links to External Site)
Cause:   State error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC