PT-2012-5564 · Digium · Asterisk Digiumphones+3

Alan Frisch · Published 2012-08-31 · Updated 2013-04-19 · CVE-2012-4737

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.8.x through 1.8.15.0 Asterisk Open Source version 10.x through 10.7.0 Certified Asterisk versions 1.8.11 through 1.8.11-cert6 Asterisk Digiumphones versions 10.x.x-digiumphones through 10.7.0-digiumphones Asterisk Business Edition C.3.x through C.3.7.5

Description The issue allows remote authenticated users to bypass intended outbound-call restrictions by leveraging the availability of peer credentials, due to the lack of ACL rule enforcement during certain uses of these credentials.

Recommendations For Asterisk Open Source versions 1.8.x through 1.8.15.0, update to version 1.8.15.1 or later. For Asterisk Open Source version 10.x through 10.7.0, update to version 10.7.1 or later. For Certified Asterisk versions 1.8.11 through 1.8.11-cert6, update to version 1.8.11-cert7 or later. For Asterisk Digiumphones versions 10.x.x-digiumphones through 10.7.0-digiumphones, update to version 10.7.1-digiumphones or later. For Asterisk Business Edition C.3.x through C.3.7.5, update to version C.3.7.6 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-4737

DSA-2550-1

Affected Products

Asterisk Business Edition

Asterisk Digiumphones

Asterisk Open Source

Certified Asterisk

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2012-4737 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-4737 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4737 · Vendor Advisory
• http://debian.org/security/2012/dsa-2550 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-4737 · Vendor Advisory
• http://downloads.asterisk.org/pub/security/AST-2012-013.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4737 · Note
• http://securityfocus.com/bid/55335 · Note
• http://securitytracker.com/id?1027461 · Note
• http://secunia.com/advisories/50687 · Note
• http://secunia.com/advisories/50756 · Note