[Forgot Password]
Login  Register Subscribe

23631

 
 

115084

 
 

97147

 
 

909

 
 

78730

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2008-1390

Date: (C)2008-03-24   (M)2017-08-08 


The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.

CVSS Score: 9.3Access Vector: NETWORK
Exploit Score: 8.6Access Complexity: MEDIUM
Impact Score: 10.0Authentication: NONE
 Confidentiality: COMPLETE
 Integrity: COMPLETE
 Availability: COMPLETE





Reference:
SECTRACK-1019679
http://www.securityfocus.com/archive/1/archive/1/489819/100/0/threaded
BID-28316
SECUNIA-29449
SECUNIA-29470
SREASON-3764
FEDORA-2008-2554
FEDORA-2008-2620
asterisk-httpmanagerid-weak-security(41304)
http://downloads.digium.com/pub/security/AST-2008-005.html

CWE    1
CWE-255

© 2013 SecPod Technologies