Detections
Analytics
Asterisk IAX2 Call Number Exhaustion DoS
medium Nessus Plugin ID 40885
Language:
Synopsis
The remote VoIP service is susceptible to a denial of service attack.Description
The version of Asterisk running on the remote host appears to be using an older implementation of the IAX2 protocol that does not support call token validation. Due to a design flaw in the protocol, a remote attacker could send a large number of messages, exhausting all available call numbers in the process. This would result in a denial of service to legitimate users.Solution
Upgrade to the relevant version of Asterisk referenced in the vendor's advisory.See Also
http://downloads.asterisk.org/pub/security/AST-2009-006.html
https://www.securityfocus.com/archive/1/archive/1/506257/100/0/threaded
Plugin Details
Severity: Medium
ID: 40885
File Name: asterisk_iax2_call_number_dos.nasl
Version: 1.17
Type: remote
Family: Denial of Service
Published: 9/8/2009
Updated: 11/15/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: cpe:/a:asterisk:open_source
Required KB Items: Services/udp/iax2
Exploit Ease: No known exploits are available
Patch Publication Date: 9/3/2009
Vulnerability Publication Date: 6/12/2009
Reference Information
CVE: CVE-2009-2346
BID: 36275