CVE-2008-1923: Asterisk Appliance Developer Kit

High severity, CVSS 7.1. EPSS: 1.4% chance of exploitation in the next 30 days.

The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "early audio" to an unverified source IP address of a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed NEW message.

Affected products

• Asterisk Asterisk Appliance Developer Kit: any version
• Asterisk Asterisk Business Edition: up to and including b2.5.1; up to and including c1.8.0; version a only; version b.1.3.2 only; version b.1.3.3 only; version b.2.2.0 only; …
• Asterisk Asterisknow: up to and including 1.0.2; version 1.0 only; version 1.0.1 only
• Asterisk Open Source: version 1.0 only; version 1.0.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.4 only; …
• Asterisk s800i: up to and including 1.1.0.2; version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.3.3 only; …

Published 2008-04-23. Last modified 2026-06-16.