NVD

Id
24952  
Name
CVE-2015-3008  
Description
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before 1.8.28-cert5, 11.6 before 11.6-cert11, and 13.1 before 13.1-cert2, when registering a SIP TLS device, does not properly handle a null byte in a domain name in the subject"s Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2015-04-10  
Modified Date
2016-12-02  
Seq
2015-3008  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
131567 24952 CVE-2015-3008 http://advisories.mageia.org/MGASA-2015-0153.html  View
131568 24952 CVE-2015-3008 http://downloads.asterisk.org/pub/security/AST-2015-003.html  View
131569 24952 CVE-2015-3008 FEDORA-2015-5948  View
131570 24952 CVE-2015-3008 http://packetstormsecurity.com/files/131364/Asterisk-Project-Security-Advisory-AST-2015-003.html  View
131571 24952 CVE-2015-3008 20150408 AST-2015-003: TLS Certificate Common name NULL byte exploit  View
131572 24952 CVE-2015-3008 20150408 AST-2015-003: TLS Certificate Common name NULL byte exploit  View
131573 24952 CVE-2015-3008 74022  View
131574 24952 CVE-2015-3008 1032052  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
6887 JVNDB-2015-002207 Asterisk Open Source および Certified Asterisk における任意の SSL サーバになりすまされる脆弱性 Asterisk Open Source および Certified Asterisk は、SIP TLS デバイスを登録する際、X.509 証明書のサブジェクトの Common Name (CN) フィールド内のドメイン名の NULL バイトを適切に処理しないため、任意の SSL サーバになりすまされる脆弱性が存在します。 CVE-2015-3008 80233 CVE-2015-3008 24952 4.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002207.html 2015-03-04 2015-05-20 View