Think you have a false positive on this rule?

Sid 1-20391

Message

PROTOCOL-VOIP Digium Asterisk Attribute header rtpmap field buffer overflow attempt

Summary

Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit before 1.4 revision 109386, and s800i 1.1.x before 1.1.0.2 allow remote attackers to (1) write a zero to an arbitrary memory location via a large RTP payload number, related to the astrtpunsetmtype function in main/rtp.c; or (2) write certain integers to an arbitrary memory location via a large number of RTP payloads, related to the processsdp function in channels/chansip.c.

Impact

CVSS base score 7.5 CVSS impact score 6.4 CVSS exploitability score 10.0 confidentialityImpact PARTIAL integrityImpact PARTIAL availabilityImpact PARTIAL

CVE-2008-1289:

CVSS base score 7.5

CVSS impact score 6.4

CVSS exploitability score 10.0

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Detailed information

CVE-2008-1289: Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit before 1.4 revision 109386, and s800i 1.1.x before 1.1.0.2 allow remote attackers to (1) write a zero to an arbitrary memory location via a large RTP payload number, related to the astrtpunsetmtype function in main/rtp.c; or (2) write certain integers to an arbitrary memory location via a large number of RTP payloads, related to the processsdp function in channels/chansip.c.

Affected systems

  • asterisk asteriskappliancedeveloper_kit 1.4
  • asterisk asteriskbusinessedition c.1.0-beta8
  • asterisk asteriskbusinessedition c.1.0beta7
  • asterisk asterisknow 1.0.1
  • asterisk open_source 1.4.18
  • asterisk open_source 1.4.19
  • asterisk opensource 1.6.0beta5
  • asterisk s800i 1.1.0.1

Ease of attack

CVE-2008-1289:

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

False positives

None known

False negatives

None known

Corrective action

Upgrade to the latest non-affected version of the software.

Apply the appropriate vendor supplied patches.

Contributors

  • Talos research team.
  • This document was generated from data supplied by the national vulnerability database, a product of the national institute of standards and technology.
  • For more information see nvd.

Additional References