PT-2014-8509 · Sangoma · Asterisk

Jonathan Rose · Publicado 2014-11-24 · Atualizado 2019-07-16 · CVE-2014-8413

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 12.x through 12.7.0 Asterisk Open Source versions 13.x through 13.0.0

Description The issue concerns the res pjsip acl module, which fails to properly create and load ACLs defined in pjsip.conf at startup. This allows remote attackers to bypass intended PJSIP ACL rules.

Recommendations For Asterisk Open Source versions 12.x through 12.7.0, update to version 12.7.1 or later. For Asterisk Open Source versions 13.x through 13.0.0, update to version 13.0.1 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-8413

Produtos afetados

Asterisk

Referências · 6

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8413 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-8413 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-8413 · Aviso do Fabricante
• http://downloads.asterisk.org/pub/security/AST-2014-013.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-8413 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-8413 · Aviso do Fabricante