PT-2018-11058 · Sangoma · Asterisk

Errentazaria + 1 · Publicado 2018-06-12 · Atualizado 2019-03-29 · CVE-2018-12227

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 13.x before 13.21.1 Asterisk Open Source versions 14.x before 14.7.7 Asterisk Open Source versions 15.x before 15.4.1 Certified Asterisk versions 13.18-cert before 13.18-cert4 Certified Asterisk versions 13.21-cert before 13.21-cert2

Description An issue in Asterisk allows disclosure of which requests hit a defined endpoint when endpoint-specific ACL rules block a SIP request. Normally, blocked requests respond with a 403 forbidden. However, if an endpoint is not identified, a 401 unauthorized response is sent instead. This does not allow ACL rules to be bypassed to gain access to the disclosed endpoints.

Recommendations For Asterisk Open Source versions 13.x before 13.21.1, update to version 13.21.1 or later. For Asterisk Open Source versions 14.x before 14.7.7, update to version 14.7.7 or later. For Asterisk Open Source versions 15.x before 15.4.1, update to version 15.4.1 or later. For Certified Asterisk versions 13.18-cert before 13.18-cert4, update to version 13.18-cert4 or later. For Certified Asterisk versions 13.21-cert before 13.21-cert2, update to version 13.21-cert2 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-12227

DSA-4320-1

Produtos afetados

Asterisk

Referências · 23

• https://nvd.nist.gov/vuln/detail/CVE-2018-12227 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17281 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7286 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12227 · Nota
• https://packages.debian.org/src:asterisk · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-12227 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7284 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-12227 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/asterisk · Aviso do Fabricante
• https://exploit-db.com/exploits/44184 · Nota
• http://downloads.asterisk.org/pub/security/AST-2018-008.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4320-1 · Aviso do Fabricante
• https://issues.asterisk.org/jira/browse/ASTERISK-27818 · Aviso do Fabricante
• https://exploit-db.com/exploits/44181 · Nota
• https://security.gentoo.org/glsa/201811-11 · Aviso do Fabricante