PT-2006-3004 · Digium · Asterisk@Home

Publicado 2006-04-25 · Atualizado 2018-10-18 · CVE-2006-2020

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Asterisk@Home versions prior to 2.8

Description The issue concerns insufficient access control in the Asterisk Recording Interface (ARI) of Asterisk@Home, which allows remote attackers to obtain password information by accessing recordings/includes/main.conf under the web document root.

Recommendations For versions prior to 2.8, restrict access to the recordings/includes/main.conf file to prevent unauthorized access until a fixed version is available.

Exploit

Correção

Identificadores relacionados

CVE-2006-2020

Produtos afetados

Asterisk@Home

Referências · 9

• 🔥 http://secunia.com/advisories/19744 · Exploit
• 🔥 https://exploit-db.com/exploits/27716 · Exploit
• 🔥 http://securiweb.net/wiki/Ressources/AvisDeSecurite/2006.1 · Exploit
• 🔥 http://osvdb.org/24805 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2020 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25993 · Nota
• http://securityfocus.com/bid/17641 · Nota
• http://securityfocus.com/archive/1/431655/100/0/threaded · Nota
• http://vupen.com/english/advisories/2006/1457 · Nota