CVE Feed

    Dashboard / CVE / CVE-2008-1333

    CVE-2008-1333

    Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call, or (2) the astman_append function.

    Published:Mar 20, 2008
    Last Modified:Apr 23, 2026
    EPS:Mar 20, 2008
    EPSS Score:0.03255
    CVSS Score:5.8

    Affected Products

    Vendor
    Asterisk
    Product
    Open Source

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-135 Format String Injection
    CAPEC-67 String Format Overflow in syslog()

    Related CVEs

    CVE-2013-2685 (CVSS 7.5) — Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows re…
    CVE-2013-2264 (CVSS 5) — The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.…
    CVE-2013-2686 (CVSS 5) — main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x be…
    CVE-2012-2186 (CVSS 9) — Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x be…
    CVE-2012-2948 (CVSS 4) — chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 an…
    CVE-2012-2416 (CVSS 6.5) — chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.11.1 and 10.x before 10.3.1 and …
    CVE-2012-2415 (CVSS 6.5) — Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x befor…
    CVE-2012-2414 (CVSS 6.5) — main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1…
    CVE-2012-0885 (CVSS 4.3) — chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is us…
    CVE-2011-4063 (CVSS 6.8) — chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 d…

    References

    http://downloads.digium.com/pub/security/AST-2008-004.html
    http://secunia.com/advisories/29426
    http://secunia.com/advisories/29456
    http://securitytracker.com/id?1019630
    http://www.asterisk.org/node/48466
    http://www.debian.org/security/2008/dsa-1525
    http://www.securityfocus.com/archive/1/489823/100/0/threaded
    http://www.securityfocus.com/bid/28311
    http://www.vupen.com/english/advisories/2008/0928
    https://exchange.xforce.ibmcloud.com/vulnerabilities/41301
    http://downloads.digium.com/pub/security/AST-2008-004.html
    http://secunia.com/advisories/29426
    http://secunia.com/advisories/29456
    http://securitytracker.com/id?1019630
    http://www.asterisk.org/node/48466
    http://www.debian.org/security/2008/dsa-1525
    http://www.securityfocus.com/archive/1/489823/100/0/threaded
    http://www.securityfocus.com/bid/28311
    http://www.vupen.com/english/advisories/2008/0928
    https://exchange.xforce.ibmcloud.com/vulnerabilities/41301

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High