PT-2006-5151 · Digium · Asterisk

Publicado 2006-08-24 · Atualizado 2018-10-17 · CVE-2006-4346

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Asterisk version 1.2.10

Description The issue allows remote attackers to execute code or overwrite files. This is achieved through the use of client-controlled variables in the Record function, such as the CALLERIDNAME variable, which can be manipulated to include format string specifiers for code execution or to perform directory traversals for file overwriting.

Recommendations For Asterisk version 1.2.10, consider restricting the use of client-controlled variables in the Record function to minimize the risk of exploitation. As a temporary workaround, restrict access to the Record function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2006-4346

Produtos afetados

Asterisk

Referências · 15

• http://sineapps.com/news.php?rssid=1448 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4346 · Nota
• http://securitytracker.com/id?1016742 · Correção
• http://securityfocus.com/bid/19683 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2006-4346 · Nota de Segurança
• http://securityfocus.com/archive/1/444322/100/0/threaded · Nota
• http://secunia.com/advisories/22651 · Nota
• http://gentoo.org/security/en/glsa/glsa-200610-15.xml · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-4346 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2006-4346 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/3372 · Nota
• https://osv.dev/vulnerability/CVE-2006-4346 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28544 · Nota
• http://labs.musecurity.com/advisories/MU-200608-01.txt · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28564 · Nota