Lucene search
MitreCVE-2008-3264HistoryJul 24, 2008 - 3:41 p.m.
CVE-2008-3264
2008-07-2415:41:00
CWE-287
mitre
web.nvd.nist.gov
45
asterisk
open source
firmware
denial of service
iax2
security vulnerability
CVSS2
7.8
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
AI Score
6.3
Confidence
Low
EPSS
0.085
Percentile
94.5%
The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers to cause a denial of service (traffic amplification) via an IAX2 FWDOWNL request.
Affected configurations
Node
asterisks800i_applianceMatch1.0
ORasterisks800i_applianceMatch1.0.1
ORasterisks800i_applianceMatch1.0.2
ORasterisks800i_applianceMatch1.0.3
asteriskasterisk_appliance_developer_kitMatch0.2
ORasteriskasterisk_appliance_developer_kitMatch0.3
ORasteriskasterisk_appliance_developer_kitMatch0.4
ORasteriskasterisk_appliance_developer_kitMatch0.5
ORasteriskasterisk_appliance_developer_kitMatch0.6
ORasteriskasterisk_appliance_developer_kitMatch0.6.0
ORasteriskasterisk_appliance_developer_kitMatch0.7
ORasteriskasterisk_appliance_developer_kitMatch0.8
ORasteriskasterisk_business_editionMatcha
ORasteriskasterisk_business_editionMatchb
ORasteriskasterisk_business_editionMatchb.1.3.2
ORasteriskasterisk_business_editionMatchb.1.3.3
ORasteriskasterisk_business_editionMatchb.2.2.0
ORasteriskasterisk_business_editionMatchb.2.2.1
ORasteriskasterisk_business_editionMatchb.2.3.1
ORasteriskasterisk_business_editionMatchb.2.3.2
ORasteriskasterisk_business_editionMatchb.2.3.3
ORasteriskasterisk_business_editionMatchb.2.3.4
ORasteriskasterisk_business_editionMatchb.2.3.6
ORasteriskasterisk_business_editionMatchb.2.5.0
ORasteriskasterisk_business_editionMatchb.2.5.3
ORasteriskasterisk_business_editionMatchb2.5.1
ORasteriskasterisk_business_editionMatchb2.5.2
ORasteriskasterisk_business_editionMatchc
ORasteriskasterisk_business_editionMatchc.1.0-beta7
ORasteriskasterisk_business_editionMatchc.1.0-beta8
ORasteriskasterisk_business_editionMatchc.1.6
ORasteriskasterisk_business_editionMatchc.1.6.1
ORasteriskasterisk_business_editionMatchc.1.6.2
ORasteriskasterisk_business_editionMatchc1.8.0
ORasteriskasterisk_business_editionMatchc1.8.1
ORasteriskasterisknowMatchbeta_5
ORasteriskasterisknowMatchbeta_6
ORasteriskasterisknowMatchbeta_7
ORasteriskasterisknowMatchpre-release
ORasteriskopen_sourceMatch1.0
ORasteriskopen_sourceMatch1.0.0
ORasteriskopen_sourceMatch1.0.1
ORasteriskopen_sourceMatch1.0.2
ORasteriskopen_sourceMatch1.0.3
ORasteriskopen_sourceMatch1.0.3.4
ORasteriskopen_sourceMatch1.0.4
ORasteriskopen_sourceMatch1.0.5
ORasteriskopen_sourceMatch1.0.6
ORasteriskopen_sourceMatch1.0.7
ORasteriskopen_sourceMatch1.0.8
ORasteriskopen_sourceMatch1.0.9
ORasteriskopen_sourceMatch1.0.11
ORasteriskopen_sourceMatch1.0.11.1
ORasteriskopen_sourceMatch1.0.12
ORasteriskopen_sourceMatch1.2.0
ORasteriskopen_sourceMatch1.2.0beta1
ORasteriskopen_sourceMatch1.2.0beta2
ORasteriskopen_sourceMatch1.2.1
ORasteriskopen_sourceMatch1.2.2
ORasteriskopen_sourceMatch1.2.3
ORasteriskopen_sourceMatch1.2.4
ORasteriskopen_sourceMatch1.2.5
ORasteriskopen_sourceMatch1.2.6
ORasteriskopen_sourceMatch1.2.7
ORasteriskopen_sourceMatch1.2.7.1
ORasteriskopen_sourceMatch1.2.8
ORasteriskopen_sourceMatch1.2.9
ORasteriskopen_sourceMatch1.2.9.1
ORasteriskopen_sourceMatch1.2.10
ORasteriskopen_sourceMatch1.2.11
ORasteriskopen_sourceMatch1.2.12
ORasteriskopen_sourceMatch1.2.12.1
ORasteriskopen_sourceMatch1.2.13
ORasteriskopen_sourceMatch1.2.14
ORasteriskopen_sourceMatch1.2.15
ORasteriskopen_sourceMatch1.2.16
ORasteriskopen_sourceMatch1.2.17
ORasteriskopen_sourceMatch1.2.18
ORasteriskopen_sourceMatch1.2.19
ORasteriskopen_sourceMatch1.2.20
ORasteriskopen_sourceMatch1.2.21
ORasteriskopen_sourceMatch1.2.21.1
ORasteriskopen_sourceMatch1.2.22
ORasteriskopen_sourceMatch1.2.23
ORasteriskopen_sourceMatch1.2.24
ORasteriskopen_sourceMatch1.2.25
ORasteriskopen_sourceMatch1.2.26
ORasteriskopen_sourceMatch1.2.26.1
ORasteriskopen_sourceMatch1.2.26.2
ORasteriskopen_sourceMatch1.2.27
ORasteriskopen_sourceMatch1.2.28
ORasteriskopen_sourceMatch1.2.29
ORasteriskopen_sourceMatch1.4.0
ORasteriskopen_sourceMatch1.4.1
ORasteriskopen_sourceMatch1.4.2
ORasteriskopen_sourceMatch1.4.3
ORasteriskopen_sourceMatch1.4.4
ORasteriskopen_sourceMatch1.4.5
ORasteriskopen_sourceMatch1.4.6
ORasteriskopen_sourceMatch1.4.7
ORasteriskopen_sourceMatch1.4.7.1
ORasteriskopen_sourceMatch1.4.8
ORasteriskopen_sourceMatch1.4.9
ORasteriskopen_sourceMatch1.4.10
ORasteriskopen_sourceMatch1.4.10.1
ORasteriskopen_sourceMatch1.4.11
ORasteriskopen_sourceMatch1.4.12
ORasteriskopen_sourceMatch1.4.12.1
ORasteriskopen_sourceMatch1.4.13
ORasteriskopen_sourceMatch1.4.14
ORasteriskopen_sourceMatch1.4.15
ORasteriskopen_sourceMatch1.4.16
ORasteriskopen_sourceMatch1.4.16.1
ORasteriskopen_sourceMatch1.4.16.2
ORasteriskopen_sourceMatch1.4.17
ORasteriskopen_sourceMatch1.4.18
ORasteriskopen_sourceMatch1.4.18.1
ORasteriskopen_sourceMatch1.4.19
ORasteriskopen_sourceMatch1.4.19.1
ORasteriskopen_sourceMatch1.4.19_rc3
ORasteriskopen_sourceMatch1.4_revision_95946
ORasteriskopen_sourceMatch1.4beta
| Vendor | Product | Version | CPE |
|---|---|---|---|
| asterisk | open_source | 1.4.2 | cpe:/a:asterisk:open_source:1.4.2::: |
| asterisk | asterisk_business_edition | c1.8.0 | cpe:/a:asterisk:asterisk_business_edition:c1.8.0::: |
| asterisk | open_source | 1.0.9 | cpe:/a:asterisk:open_source:1.0.9::: |
| asterisk | open_source | 1.4.8 | cpe:/a:asterisk:open_source:1.4.8::: |
| asterisk | open_source | 1.2.19 | cpe:/a:asterisk:open_source:1.2.19::: |
| asterisk | asterisknow | beta+7 | cpe:/a:asterisk:asterisknow:beta+7::: |
| asterisk | open_source | 1.2.27 | cpe:/a:asterisk:open_source:1.2.27::: |
| asterisk | open_source | 1.2.2 | cpe:/a:asterisk:open_source:1.2.2::: |
| asterisk | open_source | 1.2.24 | cpe:/a:asterisk:open_source:1.2.24::: |
| asterisk | asterisk_appliance_developer_kit | 0.6.0 | cpe:/a:asterisk:asterisk_appliance_developer_kit:0.6.0::: |
References
downloads.digium.com/pub/security/AST-2008-011.html
secunia.com/advisories/31178
secunia.com/advisories/31194
secunia.com/advisories/34982
security.gentoo.org/glsa/glsa-200905-01.xml
www.securityfocus.com/archive/1/494676/100/0/threaded
www.securityfocus.com/bid/30350
www.securitytracker.com/id?1020536
www.vupen.com/english/advisories/2008/2168/references
exchange.xforce.ibmcloud.com/vulnerabilities/43955
www.redhat.com/archives/fedora-package-announce/2008-July/msg00839.html
Related
nessus
nessus
Asterisk IAX2 FWDOWNL Request Spoofing Remote DoS
2008-07-24 00:00:00
Fedora 8 : asterisk-1.4.21.2-1.fc8 (2008-6676)
2008-07-24 00:00:00
Fedora 9 : asterisk-1.6.0-0.19.beta9.fc9 (2008-6853)
2008-07-31 00:00:00
seebug
seebug
Asterisk IAX2固件升级报文放大远程拒绝服务漏洞
2008-07-25 00:00:00
nvd
nvd
CVE-2008-3264
2008-07-24 15:41:00
ubuntucve
ubuntucve
CVE-2008-3264
2008-07-24 00:00:00
debiancve
debiancve
CVE-2008-3264
2008-07-24 15:41:00
cvelist
cvelist
CVE-2008-3264
2008-07-24 15:18:00
prion
prion
Server side request forgery (ssrf)
2008-07-24 15:41:00
openvas
openvas
Fedora Update for asterisk FEDORA-2008-6676
2009-02-17 00:00:00
Fedora Update for asterisk FEDORA-2008-6853
2009-02-17 00:00:00
Fedora Update for asterisk FEDORA-2008-6853
2009-02-17 00:00:00
fedora
fedora
[SECURITY] Fedora 8 Update: asterisk-1.4.21.2-1.fc8
2008-07-24 02:11:44
[SECURITY] Fedora 9 Update: asterisk-1.6.0-0.19.beta9.fc9
2008-07-30 20:07:58
securityvulns
securityvulns
Asterisk multiple security vulnerabilities
2008-07-24 00:00:00
gentoo
gentoo
Asterisk: Multiple vulnerabilities
2009-05-02 00:00:00
CVSS2
7.8
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
AI Score
6.3
Confidence
Low
EPSS
0.085
Percentile
94.5%
Related for CVE-2008-3264