CVE-2008-1923

Severity: high (CVSS 7.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-04-23 · updated 2026-06-16
Weakness: CWE-16

Description

The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "early audio" to an unverified source IP address of a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed NEW message.

Affected products

Asterisk Appliance Developer Kit: all versions
Asterisk Business Edition: through b2.5.1; through c1.8.0; a, b.1.3.2, b.1.3.3, b.2.2.0, b.2.2.1, b.2.3.1 (+8)
Asterisknow: through 1.0.2; 1.0, 1.0.1
asterisk Open Source: 1.0, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4 (+103)
asterisk S800I: through 1.1.0.2; 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.3.3, 1.1.0 (+1)

References

Get alerted when CVE-2008-1923 or the next vulnerability affects your stack