PT-2006-3005 · Digium · Asterisk@Home

Francois Harvey · Published 2006-04-25 · Updated 2018-10-18 · CVE-2006-2021

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Asterisk@Home versions prior to 2.8

Description The issue allows remote attackers to read arbitrary MP3, WAV, and GSM files via a full pathname in the recording parameter in the Asterisk Recording Interface (ARI) web interface. This can also be used to determine the existence of files.

Recommendations For versions prior to 2.8, update to version 2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the recordings/misc/audio.php file to minimize the risk of exploitation. Avoid using the recording parameter with full pathnames in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-2021

Affected Products

Asterisk@Home

References · 9

• 🔥 http://secunia.com/advisories/19744 · Exploit
• 🔥 http://securiweb.net/wiki/Ressources/AvisDeSecurite/2006.1 · Exploit
• 🔥 http://securityfocus.com/bid/17641 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2021 · Security Note
• http://securityreason.com/securityalert/750 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25996 · Note
• http://osvdb.org/24806 · Note
• http://securityfocus.com/archive/1/431655/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/1457 · Note