CVE-2008-0095 in Asterisk
Summary
by MITRE
The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit before Asterisk 1.4 revision 95946, and Appliance s800i 1.0.x before 1.0.3.4 allows remote attackers to cause a denial of service (daemon crash) via a BYE message with an Also (Also transfer) header, which triggers a NULL pointer dereference.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/01/2025
The vulnerability identified as CVE-2008-0095 represents a critical denial of service flaw affecting the SIP channel driver in various versions of Asterisk Open Source and related products. This issue specifically manifests when the system processes a BYE message containing an Also transfer header, creating a condition that leads to daemon crashes and system unavailability. The vulnerability resides in the handling of SIP protocol messages within the Asterisk telephony platform, which serves as a foundational component for voice over IP communications in numerous enterprise and telecommunications environments.
The technical root cause of this vulnerability stems from a NULL pointer dereference condition that occurs during the processing of SIP BYE messages with Also headers. When the SIP channel driver encounters such a message, it attempts to access a memory location that has not been properly initialized or allocated, resulting in a segmentation fault that terminates the Asterisk daemon process. This type of flaw falls under CWE-476 which specifically addresses NULL pointer dereference conditions in software implementations. The vulnerability demonstrates a classic buffer over-read or improper memory management issue where the application fails to validate input parameters before attempting to dereference pointers, leading to system instability and complete service disruption.
The operational impact of this vulnerability extends beyond simple service interruption, as it affects the reliability and availability of telephony infrastructure that many organizations depend upon for critical communications. Attackers can exploit this weakness remotely without requiring authentication, making it particularly dangerous in environments where Asterisk servers are exposed to untrusted networks or internet-facing SIP endpoints. The vulnerability affects multiple product lines including Asterisk Open Source versions 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, and various appliance versions, indicating a widespread exposure across different deployment scenarios. This vulnerability directly aligns with ATT&CK technique T1499.004 which covers network denial of service attacks, and can be classified under T1566.001 for malicious code delivery through network protocols.
Organizations affected by this vulnerability should prioritize immediate remediation through the application of official patches released by the Asterisk project. The recommended mitigation strategy involves upgrading to Asterisk version 1.4.17 or later, which includes fixes for the NULL pointer dereference condition in the SIP channel driver. Network administrators should also implement additional protective measures such as SIP firewall rules, rate limiting for incoming SIP messages, and monitoring for suspicious BYE message patterns. Security teams should consider implementing intrusion detection systems that can identify and block malformed SIP messages containing Also headers, as these represent the specific exploitation vector for this vulnerability. The fix addresses the core memory management issue by ensuring proper validation of SIP message headers before attempting any pointer dereference operations, thereby preventing the daemon crash condition that occurred in vulnerable versions.