CVE-2008-2119

Asterisk Open Source < 1.2.29 and Business Edition < B.2.5.3 - Denial of Service via SIP INVITE Without From Header

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-2119. PoCs published by Armando Oliveira.

AI-analyzed exploit summary This exploit sends a malformed SIP INVITE request to trigger a remote crash in Asterisk's SIP channel driver when running in pedantic mode. It leverages a vulnerability in the SIP protocol handling to cause a denial of service.

Description

Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Armando Oliveira · perldosmultiple

https://www.exploit-db.com/exploits/5749

View Code ZIP pw:eip

This exploit sends a malformed SIP INVITE request to trigger a remote crash in Asterisk's SIP channel driver when running in pedantic mode. It leverages a vulnerability in the SIP protocol handling to cause a denial of service.

Classification

Working Poc 90%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: Asterisk (SIP channel driver in pedantic mode)

No auth needed

Prerequisites: Network access to the target Asterisk server · Asterisk running in pedantic mode

MITRE ATT&CK