[Forgot Password]
Login  Register Subscribe

24436

 
 

131815

 
 

116564

 
 

909

 
 

91325

 
 

141

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML view JSON

CVE-2008-1390Date: (C)2008-03-24   (M)2018-02-19


The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 9.3
Exploit Score: 8.6
Impact Score: 10.0
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality: COMPLETE
Integrity: COMPLETE
Availability: COMPLETE
  
Reference:
SECTRACK-1019679
http://www.securityfocus.com/archive/1/archive/1/489819/100/0/threaded
BID-28316
SECUNIA-29449
SECUNIA-29470
SREASON-3764
FEDORA-2008-2554
FEDORA-2008-2620
asterisk-httpmanagerid-weak-security(41304)
http://downloads.digium.com/pub/security/AST-2008-005.html

CWE    1
CWE-255

© SecPod Technologies