VDB

CVE-2008-1897

CVE-2008-1897 PUBLISHED CVSS 4.300000190734863 MEDIUM

The IAX2 channel driver (chan_iax2) in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow unauthenticated calls, does not verify that an ACK response contains a call number matching the server's reply to a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed ACK response that does not complete a 3-way handshake. NOTE: this issue exists because of an incomplete fix for CVE-2008-1923.

EPSS 3.05% · 87.0th percentile

Risk Scores

CVSS 2.0
4.300000190734863
EPSS Score
3.05%
87.0th percentile

Affected Products

VendorProductVersions
n/an/a*
asteriskasterisk_business_editionb.2.2.1, b.2.3.2, b.2.3.1
asteriskasterisk_appliance_developer_kit0.6.0, 0.7, 0.8
asteriskopen_source1.2.6, 1.2.6, 1.2.7
asteriskasterisknow1.0.1, 1.0, 0
asterisks800i1.0.3.3, 1.0.3, 1.0.2

Timeline

  • Apr 23, 2008 CVE Published
  • Feb 4, 2022 EPSS Score
  • Mar 29, 2022 EPSS Score
  • Jul 12, 2022 EPSS Score
  • Sep 4, 2022 EPSS Score
  • Oct 26, 2022 EPSS Score
  • Dec 18, 2022 EPSS Score
  • Mar 7, 2023 EPSS Score
  • Mar 31, 2023 EPSS Score
  • Apr 3, 2023 EPSS Score
  • May 25, 2023 EPSS Score
  • Sep 8, 2023 EPSS Score

References

…and 8 more

Open in Interactive Console →
$ Console Community · 100/wk Open console ›