CVE-2008-1390 Weak cryptography in n/a

Critical 9.3 Published 24 Mar 2008 Updated 7 Aug 2024

Remote attackers can hijack Asterisk manager sessions by guessing insufficiently random IDs, leading to unauthorized control.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2008-1390?

CVE-2008-1390 is a critical vulnerability in n/a, published on 24 Mar 2008. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.

Weakness: CWE-255

Which versions are affected by CVE-2008-1390?

It affects 5 products.

Products include Asterisk Asterisk, Asterisk Asterisk Appliance Developer Kit, Asterisk Asterisk Business Edition, Asterisk Asterisknow, Asterisk S800i.

How do I fix CVE-2008-1390?

Upgrade to a fixed version.

Is CVE-2008-1390 being exploited?

There is no known exploitation of CVE-2008-1390 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2008-1390, GHSA-4h7j-rpcg-6w8h.