Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2008-1390

The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.

Published

2008-03-24T17:44:00.000

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.3 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.6

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-255
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application asterisk asterisk 1.4.1 Yes
Application asterisk asterisk 1.4.2 Yes
Application asterisk asterisk 1.4.3 Yes
Application asterisk asterisk 1.4.4 Yes
Application asterisk asterisk 1.4.5 Yes
Application asterisk asterisk 1.4.6 Yes
Application asterisk asterisk 1.4.7 Yes
Application asterisk asterisk 1.4.8 Yes
Application asterisk asterisk 1.4.9 Yes
Application asterisk asterisk 1.4.10 Yes
Application asterisk asterisk 1.4.11 Yes
Application asterisk asterisk 1.4.12 Yes
Application asterisk asterisk 1.4.13 Yes
Application asterisk asterisk 1.4.14 Yes
Application asterisk asterisk 1.4.15 Yes
Application asterisk asterisk 1.4.16 Yes
Application asterisk asterisk 1.4.17 Yes
Application asterisk asterisk 1.4.18.1 Yes
Application asterisk asterisk 1.4_beta Yes
Application asterisk asterisk 1.4_revision_95946 Yes
Application asterisk asterisk 1.6 Yes
Application asterisk asterisk_appliance_developer_kit 0.2 Yes
Application asterisk asterisk_appliance_developer_kit 0.3 Yes
Application asterisk asterisk_appliance_developer_kit 0.4 Yes
Application asterisk asterisk_appliance_developer_kit 0.5 Yes
Application asterisk asterisk_appliance_developer_kit 0.6 Yes
Application asterisk asterisk_appliance_developer_kit 0.7 Yes
Application asterisk asterisk_appliance_developer_kit 0.8 Yes
Application asterisk asterisk_appliance_developer_kit 1.4 Yes
Application asterisk asterisk_business_edition c.1.0-beta7 Yes
Application asterisk asterisk_business_edition c.1.0-beta8 Yes
Application asterisk asterisknow 1.0 Yes
Application asterisk asterisknow beta_5 Yes
Application asterisk asterisknow beta_6 Yes
Application asterisk asterisknow beta_7 Yes
Application asterisk s800i 1.0 Yes
Application asterisk s800i 1.0.1 Yes
Application asterisk s800i 1.0.2 Yes
Application asterisk s800i 1.0.3 Yes
Application asterisk s800i 1.1.0 Yes
References