PT-2006-3004 · Digium · Asterisk@Home

Published 2006-04-25 · Updated 2018-10-18 · CVE-2006-2020

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Asterisk@Home versions prior to 2.8

Description The issue concerns insufficient access control in the Asterisk Recording Interface (ARI) of Asterisk@Home, which allows remote attackers to obtain password information by accessing recordings/includes/main.conf under the web document root.

Recommendations For versions prior to 2.8, restrict access to the recordings/includes/main.conf file to prevent unauthorized access until a fixed version is available.

Exploit

Fix

Related Identifiers

CVE-2006-2020

Affected Products

Asterisk@Home

References · 9

• 🔥 http://secunia.com/advisories/19744 · Exploit
• 🔥 https://exploit-db.com/exploits/27716 · Exploit
• 🔥 http://securiweb.net/wiki/Ressources/AvisDeSecurite/2006.1 · Exploit
• 🔥 http://osvdb.org/24805 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2020 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25993 · Note
• http://securityfocus.com/bid/17641 · Note
• http://securityfocus.com/archive/1/431655/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/1457 · Note