CVE-2008-2119

Asterisk Business Edition < b2.5.2 - Improper Input Validation

Title source: rule

Description

Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Armando Oliveira · perldosmultiple
https://www.exploit-db.com/exploits/5749

References (11)

Scores

EPSS 0.1013
EPSS Percentile 93.1%

Details

CWE
CWE-20
Status published
Products (50)
asterisk/asterisk_business_edition b.1.3.2
asterisk/asterisk_business_edition b.1.3.3
asterisk/asterisk_business_edition b.2.2.0
asterisk/asterisk_business_edition b.2.2.1
asterisk/asterisk_business_edition b.2.3.1
asterisk/asterisk_business_edition b.2.3.2
asterisk/asterisk_business_edition b.2.3.3
asterisk/asterisk_business_edition b.2.3.4
asterisk/asterisk_business_edition b.2.5.0
asterisk/asterisk_business_edition b2.5.1
... and 40 more
Published Jun 04, 2008
Tracked Since Feb 18, 2026