CVE-2008-1897

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-04-23 · updated 2026-06-16
Weakness: CWE-287

Description

The IAX2 channel driver (chan_iax2) in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow unauthenticated calls, does not verify that an ACK response contains a call number matching the server's reply to a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed ACK response that does not complete a 3-way handshake. NOTE: this issue exists because of an incomplete fix for CVE-2008-1923.

Affected products

Asterisk Appliance Developer Kit: 0.2, 0.3, 0.4, 0.5, 0.6, 0.6.0 (+2)
Asterisk Business Edition: through b.2.5.1; through c1.8.0; a, b.1.3.2, b.1.3.3, b.2.2.0, b.2.2.1, b.2.3.1 (+10)
Asterisknow: through 1.0.2; 1.0, 1.0.1
asterisk Open Source: through 1.2.27; through 1.4.19; 1.0, 1.0-rc1, 1.0-rc2, 1.0.0, 1.0.1, 1.0.2 (+100)
asterisk S800I: through 1.1.0.2; 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.3.3, 1.1.0 (+1)

References

Get alerted when CVE-2008-1897 or the next vulnerability affects your stack