PT-2019-15535 · Sangoma+1 · Asterisk+1

Eliel Sardañons · Publicado 2019-11-22 · Atualizado 2022-06-03 · CVE-2019-18610

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sangoma Asterisk versions 13.x through 17.x Certified Asterisk versions 13.21 through 13.21-cert4

Description An issue was discovered in the manager.c file, allowing a remote authenticated Asterisk Manager Interface (AMI) user without system authorization to execute arbitrary system commands using a specially crafted Originate AMI request.

Recommendations For Sangoma Asterisk versions 13.x through 17.x, consider disabling the Originate AMI request functionality until a patch is available. For Certified Asterisk versions 13.21 through 13.21-cert4, restrict access to the AMI interface to minimize the risk of exploitation. As a temporary workaround, consider limiting the privileges of authenticated AMI users to prevent the execution of arbitrary system commands.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

ALT-PU-2020-2313

CVE-2019-18610

DLA-2017-1

DLA-2969-1

Produtos afetados

Alt Linux

Asterisk

Referências · 43

• https://osv.dev/vulnerability/DLA-2017-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15639 · Nota de Segurança
• https://bdu.fstec.ru/vul/2022-01086 · Nota de Segurança
• https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html · Nota
• https://downloads.asterisk.org/pub/security/AST-2019-007.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15297 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37325 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42705 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18610 · Aviso do Fabricante
• https://asterisk.org/downloads/security-advisories · Aviso do Fabricante
• https://safe-surf.ru/specialists/bulletins-nkcki/675928 · Nota de Segurança
• https://bdu.fstec.ru/vul/2022-02209 · Nota de Segurança
• https://packages.debian.org/src:asterisk · Nota
• https://cve.org/CVERecord?id=CVE-2019-18610 · Nota de Segurança
• http://downloads.asterisk.org/pub/security/AST-2019-007.html · Aviso do Fabricante