NVD

Id
1835  
Name
CVE-2008-1897  
Description
The IAX2 channel driver (chan_iax2) in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow unauthenticated calls, does not verify that an ACK response contains a call number matching the server"s reply to a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed ACK response that does not complete a 3-way handshake. NOTE: this issue exists because of an incomplete fix for CVE-2008-1923.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-03  
Published
2008-04-23  
Modified Date
2011-03-07  
Seq
2008-1897  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
11891 1835 CVE-2008-1897 http://bugs.digium.com/view.php?id=10078  View
11892 1835 CVE-2008-1897 http://downloads.digium.com/pub/security/AST-2008-006.html  View
11893 1835 CVE-2008-1897 GLSA-200905-01  View
11894 1835 CVE-2008-1897 http://www.altsci.com/concepts/page.php?s=asteri&p=2  View
11895 1835 CVE-2008-1897 DSA-1563  View
11896 1835 CVE-2008-1897 20080422 AST-2008-006 - 3-way handshake in IAX2 incomplete  View
11897 1835 CVE-2008-1897 28901  View
11898 1835 CVE-2008-1897 1019918  View
11899 1835 CVE-2008-1897 ADV-2008-1324  View
11900 1835 CVE-2008-1897 asterisk-iax2protocol-ack-dos(41966)  View
11901 1835 CVE-2008-1897 FEDORA-2008-3365  View
11902 1835 CVE-2008-1897 FEDORA-2008-3390  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
47660 JVNDB-2008-002970 Asterisk Open Source の IAX2 チャネルドライバにおけるサービス運用妨害 (DoS) の脆弱性 Asterisk Open Source、Business Edition、AsteriskNOW、Appliance Developer Kit および s800i の IAX2 チャネルドライバ (chan_iax2) には、サービス運用妨害 (トラフィック増幅) 状態となる脆弱性が存在します。 CVE-2008-1897 32010 CVE-2008-1897 1835 4.3 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002970.html 2008-04-22 2012-06-26 View