Vulnerability Intelligence Report
CVE-2009-2346
The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and C.3.x before C.3.1.1; and s800i 1.3.x before 1.3.0.3 allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many IAX2 message exchanges, a related issue to CVE-2008-3263.
No Active Exploit Signals
CVSS Base Score
7.8
HIGH
EPSS Probability:2.58%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| asterisk | asterisk | b.1.3.2, b.1.3.3, b.2.2.0, b.2.2.1, b.2.3.1, b.2.3.2, b.2.3.3, b.2.3.4, b.2.3.5, b.2.3.6, b.2.5.1, b.2.5.3, b.2.5.4, b.2.5.5, b.2.5.6, b.2.5.8, b.2.5.9, c.1.0_beta7, c.1.0_beta8, c.1.6, c.1.6.1, c.1.6.2, c.1.8.1, c.1.10.3, c.1.10.4, c.1.10.5, c.2.1.2.1, c.2.3, c.2.3.3, c.2.4.2, c.3.1.0 |
| asterisk | open_source | 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.7.1, 1.2.8, 1.2.9, 1.2.9.1, 1.2.10, 1.2.11, 1.2.12, 1.2.12.1, 1.2.13, 1.2.14, 1.2.15, 1.2.16, 1.2.17, 1.2.18, 1.2.19, 1.2.20, 1.2.21, 1.2.21.1, 1.2.22, 1.2.23, 1.2.24, 1.2.25, 1.2.26, 1.2.26.1, 1.2.26.2, 1.2.27, 1.2.28, 1.2.29, 1.2.30, 1.2.30.2, 1.2.30.3, 1.2.30.4, 1.2.31, 1.2.32, 1.2.33, 1.2.34, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.7.1, 1.4.8, 1.4.9, 1.4.10, 1.4.10.1, 1.4.11, 1.4.12, 1.4.12.1, 1.4.13, 1.4.14, 1.4.15, 1.4.16, 1.4.16.1, 1.4.16.2, 1.4.17, 1.4.18, 1.4.18.1, 1.4.19, 1.4.19.1, 1.4.19.2, 1.4.20, 1.4.21, 1.4.21.1, 1.4.21.2, 1.4.22, 1.4.22.1, 1.4.22.2, 1.4.23, 1.4beta, 1.6.0, 1.6.0.1, 1.6.0.2, 1.6.0.3, 1.6.1.0, 1.6.1.5 |
| asterisk | opensource | 1.4.23.2, 1.4.24, 1.4.24.1, 1.4.26, 1.4.26.1 |
| sangoma | asterisk | 1.6.1, 1.6.1.4 |
| asterisk | appliance_s800i | 1.3, 1.3.0.2 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
2.581%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2009-07-07T00:00:00 |
| Published | 2009-09-08T18:00:00 |
| Patch Date | 2009-09-03 |
| Last Updated | 2024-08-07T05:44:55 |
Community Chatter & Buzz