PT-2012-5564 · Digium · Asterisk Digiumphones+3

Alan Frisch · Publicado 2012-08-31 · Atualizado 2013-04-19 · CVE-2012-4737

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.8.x through 1.8.15.0 Asterisk Open Source version 10.x through 10.7.0 Certified Asterisk versions 1.8.11 through 1.8.11-cert6 Asterisk Digiumphones versions 10.x.x-digiumphones through 10.7.0-digiumphones Asterisk Business Edition C.3.x through C.3.7.5

Description The issue allows remote authenticated users to bypass intended outbound-call restrictions by leveraging the availability of peer credentials, due to the lack of ACL rule enforcement during certain uses of these credentials.

Recommendations For Asterisk Open Source versions 1.8.x through 1.8.15.0, update to version 1.8.15.1 or later. For Asterisk Open Source version 10.x through 10.7.0, update to version 10.7.1 or later. For Certified Asterisk versions 1.8.11 through 1.8.11-cert6, update to version 1.8.11-cert7 or later. For Asterisk Digiumphones versions 10.x.x-digiumphones through 10.7.0-digiumphones, update to version 10.7.1-digiumphones or later. For Asterisk Business Edition C.3.x through C.3.7.5, update to version C.3.7.6 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-4737

DSA-2550-1

Produtos afetados

Asterisk Business Edition

Asterisk Digiumphones

Asterisk Open Source

Certified Asterisk

Referências · 11

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4737 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4737 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2012-4737 · Aviso do Fabricante
• http://securityfocus.com/bid/55335 · Nota
• http://securitytracker.com/id?1027461 · Nota
• http://secunia.com/advisories/50687 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4737 · Aviso do Fabricante
• http://debian.org/security/2012/dsa-2550 · Aviso do Fabricante
• http://secunia.com/advisories/50756 · Nota
• https://osv.dev/vulnerability/CVE-2012-4737 · Aviso do Fabricante
• http://downloads.asterisk.org/pub/security/AST-2012-013.html · Aviso do Fabricante