CVE-2008-1333

Publication date 20 March 2008

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call, or (2) the astman_append function.

Read the notes from the security team

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
asterisk 9.10 karmic
Fixed 1:1.4.17~dfsg-2ubuntu1
9.04 jaunty
Fixed 1:1.4.17~dfsg-2ubuntu1
8.10 intrepid
Fixed 1:1.4.17~dfsg-2ubuntu1
8.04 LTS hardy
Fixed 1:1.4.17~dfsg-2ubuntu1
7.10 gutsy Ignored end of life, was needed
7.04 feisty Ignored end of life, was needed
6.10 edgy Ignored end of life, was needed
6.06 LTS dapper Ignored end of life

Notes

jdstrand

1.2 and 1.4 not exploitable, but need fix (per Debian)