CVE-2008-5744

2008-12-2621:30:00

CWE-189

mitre

web.nvd.nist.gov

cve-2008-5744

array index error

dahdi

tor2.c driver

zaptel

dahdi

kernel memory

local users

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

AI Score

5.9

Confidence

High

EPSS

0.001

Percentile

23.7%

JSON

Array index error in the dahdi/tor2.c driver in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl, related to an incorrect tor2 patch for CVE-2008-5396 that uses the wrong variable in a range check against the value of lc->sync.

Affected configurations

Nvd

Node

asteriskzaptelRange≤1.4.11

asteriskzaptelMatch1.2

asteriskzaptelMatch1.2.27

asteriskzaptelMatch1.4

VendorProductVersionCPE
asteriskzaptel*cpe:2.3:a:asterisk:zaptel:*:*:*:*:*:*:*:*
asteriskzaptel1.2cpe:2.3:a:asterisk:zaptel:1.2:*:*:*:*:*:*:*
asteriskzaptel1.2.27cpe:2.3:a:asterisk:zaptel:1.2.27:*:*:*:*:*:*:*
asteriskzaptel1.4cpe:2.3:a:asterisk:zaptel:1.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
asterisk	zaptel	*	cpe:2.3:a:asterisk:zaptel::::::::
asterisk	zaptel	1.2	cpe:2.3:a:asterisk:zaptel:1.2:::::::*
asterisk	zaptel	1.2.27	cpe:2.3:a:asterisk:zaptel:1.2.27:::::::*
asterisk	zaptel	1.4	cpe:2.3:a:asterisk:zaptel:1.4:::::::*