CVE-2008-1289
Description
Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit before 1.4 revision 109386, and s800i 1.1.x before 1.1.0.2 allow remote attackers to (1) write a zero to an arbitrary memory location via a large RTP payload number, related to the ast_rtp_unset_m_type function in main/rtp.c; or (2) write certain integers to an arbitrary memory location via a large number of RTP payloads, related to the process_sdp function in channels/chan_sip.c.
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| asterisk asterisk_appliance_developer_kit | 1.4 | — |
| asterisk asterisk_business_edition | v ≤ c.1.0-beta8, v ≤ c.1.0beta7 | — |
| asterisk asterisknow | v ≤ 1.0.1 | — |
| asterisk open_source | v ≤ 1.4.18, v ≤ 1.4.19, v ≤ 1.6.0_beta5 | — |
| asterisk s800i | v ≤ 1.1.0.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.