CVE-2008-1897

CVE-2008-1897 is a medium-severity vulnerability in Asterisk Asterisk Appliance Developer Kit with a CVSS 2.0 base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-287.

Key facts

• Severity: Medium (CVSS 2.0 base score 4.3)
• EPSS exploit prediction: 3% (84th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-287
• Affected product: Asterisk Asterisk Appliance Developer Kit
• Published: 2008-04-23
• Last modified: 2026-06-16

Description

The IAX2 channel driver (chan_iax2) in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow unauthenticated calls, does not verify that an ACK response contains a call number matching the server's reply to a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed ACK response that does not complete a 3-way handshake. NOTE: this issue exists because of an incomplete fix for CVE-2008-1923.

Frequently asked questions

What is CVE-2008-1897?

The IAX2 channel driver (chan_iax2) in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow unauthenticated calls, does not verify that an ACK response contains a call number matching the server's reply to a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed ACK response that does not complete a 3-way handshake. NOTE: this issue exists because of an incomplete fix for CVE-2008-1923.

How severe is CVE-2008-1897?

CVE-2008-1897 has a CVSS 2.0 base score of 4.3, rated medium severity.

Is CVE-2008-1897 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (84th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2008-1897?

CVE-2008-1897 primarily affects Asterisk Asterisk Appliance Developer Kit. In total, 143 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2008-1897?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2008-1897 published?

CVE-2008-1897 was published on 2008-04-23 and last updated on 2026-06-16.

References

• http://bugs.digium.com/view.php?id=10078
• http://downloads.digium.com/pub/security/AST-2008-006.html
• http://secunia.com/advisories/29927
• http://secunia.com/advisories/30010
• http://secunia.com/advisories/30042
• http://secunia.com/advisories/34982
• http://security.gentoo.org/glsa/glsa-200905-01.xml
• http://www.altsci.com/concepts/page.php?s=asteri&p=2
• http://www.debian.org/security/2008/dsa-1563
• http://www.securityfocus.com/archive/1/491220/100/0/threaded
• http://www.securityfocus.com/bid/28901
• http://www.securitytracker.com/id?1019918
• http://www.vupen.com/english/advisories/2008/1324
• https://downloads.asterisk.org/pub/security/AST-2008-006.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41966
• https://github.com/jcollie/asterisk/commit/60de4fbbdf3ede49f158e23a9e3b679f2e519c1e
• https://github.com/jcollie/asterisk/commit/771b3d8749b34b6eea4e03a2e514380da9582f90
• https://github.com/jcollie/asterisk/commit/a8b180875b037b8da26f6a3bcc8e5e98b8c904d2
• https://github.com/kaoru6/asterisk/commit/1fe14f38dd43dc894d21f85762b51208ba5c8acb
• https://github.com/lyx2014/Asterisk/commit/0670e43c30135044e25cca7f80e1833e2c128653
• https://github.com/mojolingo/asterisk/commit/20ac3662f137dbf7f42d5295590069a7d3b1166b
• https://github.com/pruiz/asterisk/commit/e0ef9bd22810c6969a7f222eec04798f19a7e2d6
• https://github.com/silentindark/asterisk-1/commit/fe8b7f31db687f8b9992864b82c93d22833019c7
• https://github.com/xrg/asterisk-xrg/commit/10da3dab24e8ca08cf2c983f8d0206e383535b5a
• https://github.com/xrg/asterisk-xrg/commit/51714a24347dc57f9a208a4a8af84115ef407b83
• https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00581.html
• https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00600.html

Affected products (143)

• cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:0.2:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:0.3:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:0.4:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:0.5:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:0.6:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:0.6.0:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:0.7:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_appliance_developer_kit:0.8:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:*:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:a:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:b.1.3.2:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:b.1.3.3:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:b.2.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:b.2.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:b.2.3.1:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:b.2.3.2:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:b.2.3.3:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:b.2.3.4:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:b.2.3.6:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:b.2.5.0:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:c.1.0:beta7:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:c.1.0:beta8:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:c.1.6:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:c.1.6.1:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisk_business_edition:c.1.6.2:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisknow:*:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisknow:1.0:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:asterisknow:1.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:open_source:*:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:open_source:1.0:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:open_source:1.0:rc1:*:*:*:*:*:*
• cpe:2.3:a:asterisk:open_source:1.0:rc2:*:*:*:*:*:*
• cpe:2.3:a:asterisk:open_source:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:open_source:1.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:open_source:1.0.2:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:open_source:1.0.3:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:open_source:1.0.3.4:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:open_source:1.0.4:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:open_source:1.0.5:*:*:*:*:*:*:*
• cpe:2.3:a:asterisk:open_source:1.0.6:*:*:*:*:*:*:*

More vulnerabilities in Asterisk Asterisk Appliance Developer Kit

• CVE-2008-1390 — Critical (CVSS 9.3): The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business…
• CVE-2007-3762 — Critical (CVSS 9.3): Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8,…
• CVE-2008-1332 — High (CVSS 8.8): Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before 1.4.18.1 and 1.4.19-rc3; Business…
• CVE-2008-3264 — High (CVSS 7.8): The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before…
• CVE-2008-1289 — High (CVSS 7.5): Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before…
• CVE-2008-1923 — High (CVSS 7.1): The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when…

All CVEs affecting Asterisk Asterisk Appliance Developer Kit →

Other CWE-287 (Improper Authentication) vulnerabilities

• CVE-2026-45480 — Critical (CVSS 10.0): Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-46389 — Critical (CVSS 10.0): UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS…
• CVE-2026-10611 — Critical (CVSS 10.0): An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement.…
• CVE-2026-47280 — Critical (CVSS 10.0): Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a…
• CVE-2026-42822 — Critical (CVSS 10.0): Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges…
• CVE-2026-20182 — Critical (CVSS 10.0): May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and…

Browse all CWE-287 (Improper Authentication) vulnerabilities →