CVE-2008-0095: Asterisk Appliance Developer Kit

Medium severity, CVSS 5.0. EPSS: 25.4% chance of exploitation in the next 30 days.

The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit before Asterisk 1.4 revision 95946, and Appliance s800i 1.0.x before 1.0.3.4 allows remote attackers to cause a denial of service (daemon crash) via a BYE message with an Also (Also transfer) header, which triggers a NULL pointer dereference.

Affected products

• Asterisk Asterisk Appliance Developer Kit: up to and including 1.4_revision_95945
• Asterisk Asterisk Business Edition: up to and including c.1.0beta7
• Asterisk Asterisknow: up to and including beta_6
• Asterisk Open Source: up to and including 1.4.16
• Asterisk s800i: up to and including 1.0.3.3

Published 2008-01-08. Last modified 2026-06-16.