CVE

Id
31507  
CVE No.
CVE-2008-1390  
Status
Candidate  
Description
The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.  
Phase
Assigned (20080318)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
338092 31507 CVE-2008-1390 BUGTRAQ:20080318 AST-2008-005: HTTP Manager ID is predictable  View
338093 31507 CVE-2008-1390 URL:http://www.securityfocus.com/archive/1/archive/1/489819/100/0/threaded  View
338094 31507 CVE-2008-1390 CONFIRM:http://downloads.digium.com/pub/security/AST-2008-005.html  View
338095 31507 CVE-2008-1390 FEDORA:FEDORA-2008-2554  View
338096 31507 CVE-2008-1390 URL:https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00438.html  View
338097 31507 CVE-2008-1390 FEDORA:FEDORA-2008-2620  View
338098 31507 CVE-2008-1390 URL:https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00514.html  View
338099 31507 CVE-2008-1390 BID:28316  View
338100 31507 CVE-2008-1390 URL:http://www.securityfocus.com/bid/28316  View
338101 31507 CVE-2008-1390 SECTRACK:1019679  View
338102 31507 CVE-2008-1390 URL:http://www.securitytracker.com/id?1019679  View
338103 31507 CVE-2008-1390 SECUNIA:29449  View
338104 31507 CVE-2008-1390 URL:http://secunia.com/advisories/29449  View
338105 31507 CVE-2008-1390 SECUNIA:29470  View
338106 31507 CVE-2008-1390 URL:http://secunia.com/advisories/29470  View
338107 31507 CVE-2008-1390 SREASON:3764  View
338108 31507 CVE-2008-1390 URL:http://securityreason.com/securityalert/3764  View
338109 31507 CVE-2008-1390 XF:asterisk-httpmanagerid-weak-security(41304)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
50284 JVNDB-2008-005594 Plone CMS におけるアクセス権を取得される脆弱性 Plone CMS は、全ユーザアカウントの _ac クッキー内に base64 エンコードされた形式のユーザ名およびパスワードを配置するため、アクセス権を取得される脆弱性が存在します。 CVE-2008-1394 31507 7.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-005594.html  View