PT-2012-3866 · Digium · Asterisk Digiumphones+3

Zubair Ashraf · Published 2012-08-31 · Updated 2024-08-15 · CVE-2012-2186

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.8.x through 1.8.15.0 Asterisk Open Source versions 10.x through 10.7.0 Certified Asterisk version 1.8.11 through 1.8.11-cert5 Asterisk Digiumphones versions 10.x.x-digiumphones through 10.7.0-digiumphones Asterisk Business Edition versions C.3.x through C.3.7.5

Description The issue allows remote authenticated users to execute arbitrary commands by leveraging originate privileges and providing an ExternalIVR value in an AMI Originate action, such as "/api/originate" or similar API endpoints, by manipulating the ExternalIVR variable.

Recommendations For Asterisk Open Source versions 1.8.x through 1.8.15.0, update to version 1.8.15.1 or later. For Asterisk Open Source versions 10.x through 10.7.0, update to version 10.7.1 or later. For Certified Asterisk version 1.8.11 through 1.8.11-cert5, update to version 1.8.11-cert6 or later. For Asterisk Digiumphones versions 10.x.x-digiumphones through 10.7.0-digiumphones, update to version 10.7.1-digiumphones or later. For Asterisk Business Edition versions C.3.x through C.3.7.5, update to version C.3.7.6 or later.

Fix

Related Identifiers

CVE-2012-2186

DSA-2550-1

Affected Products

Asterisk Business Edition

Asterisk Digiumphones

Asterisk Open Source

Certified Asterisk

References · 11

• https://security-tracker.debian.org/tracker/CVE-2012-2186 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-2186 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2186 · Security Note
• http://debian.org/security/2012/dsa-2550 · Vendor Advisory
• http://downloads.asterisk.org/pub/security/AST-2012-012.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2186 · Vendor Advisory
• http://secunia.com/advisories/50687 · Note
• http://securitytracker.com/id?1027460 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2186 · Note
• http://secunia.com/advisories/50756 · Note
• https://t.me/cvenotify/90702 · Telegram Post