CVE-2008-1390 | BDVDB-2026-29875 Detail
Description#
The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://securityreason.com/securityalert/3764
- http://www.securityfocus.com/bid/28316
- http://www.securityfocus.com/archive/1/489819/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41304
- http://secunia.com/advisories/29449
- http://downloads.digium.com/pub/security/AST-2008-005.html
- https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00438.html
- http://www.securitytracker.com/id?1019679
- https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00514.html
- http://secunia.com/advisories/29470
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.