CVE-2015-3008

Published Apr 10, 2015 CVSS 2.0 · 4.3 Medium EPSS 46.0% KEV · Not listed
Description
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before 1.8.28-cert5, 11.6 before 11.6-cert11, and 13.1 before 13.1-cert2, when registering a SIP TLS device, does not properly handle a null byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-455-1 asterisk security update
Debian DSA Debian DSA DSA-3700-1 asterisk security update
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 6, 2024, 5:32 AM
Reserved
Apr 8, 2015, 12:00 AM
Status
Modified
Published
Apr 10, 2015, 3:00 PM
Modified
Jun 17, 2026, 12:25 AM