Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before 1.4.18.1 and 1.4.19-rc3; Business Edition A.x.x, B.x.x before B.2.5.1, and C.x.x before C.1.6.2; AsteriskNOW 1.0.x before 1.0.2; Appliance Developer Kit before 1.4 revision 109393; and s800i 1.0.x before 1.1.0.2; allows remote attackers to access the SIP channel driver via a crafted From header.

The version of Asterisk running on the remote host allows unauthenticated calls via the SIP channel driver.  Using a specially crafted From header, a remote attacker can bypass authentication and make calls into the context specified in the 'general' section of 'sip.conf'.

A remote attacker could do a call without prior login via the SIP channel. (CVE-2008-1332)

The remote host is affected by the vulnerability described in GLSA-200804-13 (Asterisk: Multiple vulnerabilities)

    Asterisk upstream developers reported multiple vulnerabilities:
    The Call Detail Record Postgres logging engine (cdr_pgsql)     does not correctly escape the ANI and DNIS arguments before using them     in SQL statements (CVE-2007-6170).
    When using database-based     registrations ('realtime') and host-based authentication, Asterisk does     not check the IP address when the username is correct and there is no     password provided (CVE-2007-6430).
    The SIP channel driver does     not correctly determine if authentication is required     (CVE-2008-1332).
  Impact :

    Remote authenticated attackers could send specially crafted data to     Asterisk to execute arbitrary SQL commands and compromise the     administrative database. Remote unauthenticated attackers could bypass     authentication using a valid username to hijack other user's sessions,     and establish sessions on the SIP channel without authentication.
  Workaround :

    There is no known workaround at this time.

Update to 1.4.18.1 plus another patch to fix some security issues.
AST-2008-002 details two buffer overflows that were discovered in RTP codec payload type handling. * http://downloads.digium.com/pub/security/AST-2008-002.pdf * All users of SIP in Asterisk 1.4 and 1.6 are affected. AST-2008-003 details a vulnerability which allows an attacker to bypass SIP authentication and to make a call into the context specified in the general section of sip.conf. * http://downloads.digium.com/pub/security/AST-2008-003.pdf * All users of SIP in Asterisk 1.0, 1.2, 1.4, or 1.6 are affected. AST-2008-005 details a problem in the way manager IDs are calculated. * http://downloads.digium.com/pub/security/AST-2008-005.pdf

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several remote vulnerabilities have been discovered in Asterisk, a free software PBX and telephony toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6430     Tilghman Lesher discovered that database-based     registrations are insufficiently validated. This only     affects setups, which are configured to run without a     password and only host-based authentication.

  - CVE-2008-1332     Jason Parker discovered that insufficient validation of     From: headers inside the SIP channel driver may lead to     authentication bypass and the potential external     initiation of calls.

  - CVE-2008-1333     This update also fixes a format string vulnerability,     which can only be triggered through configuration files     under control of the local administrator. In later     releases of Asterisk this issue is remotely exploitable     and tracked as CVE-2008-1333.

The status of the old stable distribution (sarge) is currently being investigated. If affected, an update will be released through security.debian.org.

ID	Name	Product	Family	Severity
32135	Asterisk SIP Remote Authentication Bypass	Nessus	Misc.	medium
31963	openSUSE 10 Security Update : asterisk (asterisk-5169)	Nessus	SuSE Local Security Checks	high
31960	GLSA-200804-13 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
31667	Fedora 7 : asterisk-1.4.18.1-1.fc7 (2008-2620)	Nessus	Fedora Local Security Checks	high
31664	Fedora 8 : asterisk-1.4.18.1-1.fc8 (2008-2554)	Nessus	Fedora Local Security Checks	high
31631	Debian DSA-1525-1 : asterisk - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2008-1332

critical

Tenable Plugins

medium

high

high

high

high

high