Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2008-2119

Date: June 4, 2008

Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer.

Severity Score

Related Resources (13)

https://nvd.nist.gov/vuln/detail/CVE-2008-2119
https://www.exploit-db.com/exploits/5749
http://downloads.digium.com/pub/security/AST-2008-008.html
http://www.securitytracker.com/id?1020166
http://secunia.com/advisories/30517
http://www.vupen.com/english/advisories/2008/1731
http://security.gentoo.org/glsa/glsa-200905-01.xml
http://www.securityfocus.com/archive/1/493020/100/0/threaded
http://svn.digium.com/view/asterisk?view=rev&revision=120109
https://exchange.xforce.ibmcloud.com/vulnerabilities/42823
http://secunia.com/advisories/34982
http://bugs.digium.com/view.php?id=12607
https://www.mend.io/vulnerability-database/CVE-2008-2119

Severity Score

Weakness Type (CWE)

Input Validation

CWE-20

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): LOW

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us