CVE-2008-1390

2008-03-2417:44:00

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

0.038

Percentile

92.0%

JSON

The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.

OSVersionArchitecturePackageVersionFilename
Debian11allasterisk< 1:1.4.19.1~dfsg-1asterisk_1:1.4.19.1~dfsg-1_all.deb
Debian999allasterisk< 1:1.4.19.1~dfsg-1asterisk_1:1.4.19.1~dfsg-1_all.deb