Secunia

Dino A. Dai Zovi has reported a weakness in Asterisk, which can be exploited by malicious people to hijack a user session.

The weakness is caused due to the HTTP Manager ID being predictable. This can be exploited to hijack a manager's session by guessing the session ID.

The weakness is reported in:
* Asterisk Open Source 1.4.x prior to 1.4.19-rc3
* Asterisk Open Source 1.6.x prior to 1.6.0-beta6
* Asterisk Business Edition C.x.x prior to C.1.6
* AsteriskNOW prior to 1.0.2
* Asterisk Appliance Developer Kit prior to SVN revision 104704
* s800i (Asterisk Appliance) prior to version 1.1.0.2

Solution
Asterisk Open Source 1.4.x:
Further details available in Customer Area

Provided and/or discovered by
Dino A. Dai Zovi

Original Advisory
http://downloads.digium.com/pub/security/AST-2008-005.html

Deep Links
Links available in Customer Area