NVD

Id
1347  
Name
CVE-2008-1390  
Description
The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-03  
Published
2008-03-24  
Modified Date
2008-09-05  
Seq
2008-1390  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
8680 1347 CVE-2008-1390 http://downloads.digium.com/pub/security/AST-2008-005.html  View
8681 1347 CVE-2008-1390 3764  View
8682 1347 CVE-2008-1390 20080318 AST-2008-005: HTTP Manager ID is predictable  View
8683 1347 CVE-2008-1390 28316  View
8684 1347 CVE-2008-1390 1019679  View
8685 1347 CVE-2008-1390 asterisk-httpmanagerid-weak-security(41304)  View
8686 1347 CVE-2008-1390 FEDORA-2008-2554  View
8687 1347 CVE-2008-1390 FEDORA-2008-2620  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
47549 JVNDB-2008-002859 Asterisk Open Source の AsteriskGUI HTTP サーバにおける管理者のセッションをハイジャックされる脆弱性 Asterisk Open Source、Business Edition、AsteriskNOW、Appliance Developer Kit および s800i の AsteriskGUI HTTP サーバは、不十分にランダムな管理者 ID 値を生成するため、管理者のセッションをハイジャックされる脆弱性が存在します。 CVE-2008-1390 31503 CVE-2008-1390 1347 9.3 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002859.html 2008-03-18 2012-06-26 View