vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2008-1897

N/A
Published: April 23, 2008 at 12:00 AM UTC
Updated: June 16, 2026 at 10:52 PM UTC
5 products affected across 1 vendorOpen SourceAsterisknowAsterisk Appliance Developer Kit

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 3%

Description

The IAX2 channel driver (chan_iax2) in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow unauthenticated calls, does not verify that an ACK response contains a call number matching the server's reply to a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed ACK response that does not complete a 3-way handshake. NOTE: this issue exists because of an incomplete fix for CVE-2008-1923.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Asterisk Appliance Developer Kit· Asterisk
95%
0.20.30.40.50.60.6.00.70.8
Asterisk Business Edition· Asterisk
95%
v ≤ b.2.5.1v ≤ c1.8.0ab.1.3.2b.1.3.3b.2.2.0b.2.2.1b.2.3.1b.2.3.2b.2.3.3b.2.3.4b.2.3.6b.2.5.0c.1.0 beta7c.1.0 beta8c.1.6c.1.6.1c.1.6.2
Asterisknow· Asterisk
95%
v ≤ 1.0.21.01.0.1
Open Source· Asterisk
95%
v ≤ 1.2.27v ≤ 1.4.191.01.0 rc11.0 rc21.0.01.0.11.0.111.0.11 patch1.0.11.11.0.11.1 patch1.0.121.0.12 patch1.0.21.0.31.0.3.41.0.41.0.51.0.61.0.71.0.81.0.91.2.01.2.0 beta11.2.0 beta21.2.0 rc11.2.0 rc21.2.11.2.101.2.10 netsec1.2.111.2.11 netsec1.2.121.2.12 netsec1.2.12.11.2.12.1 netsec1.2.131.2.13 netsec1.2.141.2.14 netsec1.2.151.2.15 netsec1.2.161.2.16 netsec1.2.171.2.17 netsec1.2.181.2.18 netsec1.2.191.2.19 netsec1.2.21.2.2 netsec1.2.201.2.20 netsec1.2.211.2.21 netsec1.2.21.11.2.21.1 netsec1.2.221.2.22 netsec1.2.231.2.23 netsec1.2.241.2.24 netsec1.2.251.2.25 netsec1.2.261.2.26 netsec1.2.26.11.2.26.1 netsec1.2.26.21.2.26.2 netsec1.2.31.2.3 netsec1.2.41.2.4 netsec1.2.51.2.5 netsec1.2.61.2.6 netsec1.2.71.2.7 netsec1.2.7.11.2.7.1 netsec1.2.81.2.8 netsec1.2.91.2.9.11.2.9.1 netsec1.4.01.4.0 beta21.4.0 beta31.4.0 beta41.4.11.4.101.4.10.11.4.111.4.121.4.12.11.4.131.4.141.4.151.4.161.4.16.11.4.16.21.4.171.4.181.4.18.1
S800I· Asterisk
95%
v ≤ 1.1.0.21.01.0.11.0.21.0.31.0.3.31.1.01.1.0.1

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (27)

x_refsource_CONFIRM
Source: [email protected]
http://bugs.digium.com/view.php?id=10078
x_refsource_CONFIRM
Source: [email protected]
http://downloads.digium.com/pub/security/AST-2008-006.html
Third Party AdvisoryVendor Advisory
Source: [email protected]
http://secunia.com/advisories/29927
Third Party AdvisoryVendor Advisory
Source: [email protected]
http://secunia.com/advisories/30010
Third Party AdvisoryVendor Advisory
Source: [email protected]
http://secunia.com/advisories/30042
Third Party Advisoryx_refsource_SECUNIA
Source: [email protected]
http://secunia.com/advisories/34982
Vendor Advisoryx_refsource_GENTOO
Source: [email protected]
http://security.gentoo.org/glsa/glsa-200905-01.xml
Source: [email protected]
http://www.altsci.com/concepts/page.php?s=asteri&p=2

CVSS

4.3MEDIUM[email protected]
Confidentiality
NONE
Integrity
NONE
Availability
PARTIAL
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-287

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card