PT-2014-8508 · Digium · Asterisk

Andreas Steinmetz · Published 2014-11-24 · Updated 2019-07-16 · CVE-2014-8412

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.8.x through 1.8.31, 11.x through 11.13, 12.x through 12.6, and 13.x through 13.0.0 Asterisk Open Source version 1.8.28-cert2 and earlier Asterisk Open Source version 11.6-cert7 and earlier Certified Asterisk versions 1.8.28 through 1.8.28-cert2 and 11.6 through 11.6-cert7

Description The issue allows remote attackers to bypass ACL restrictions via a packet with a source IP that does not share the address family as the first ACL entry, affecting the VoIP channel drivers, DUNDi, and Asterisk Manager Interface (AMI).

Recommendations For Asterisk Open Source versions 1.8.x through 1.8.31, update to version 1.8.32.1 or later. For Asterisk Open Source versions 11.x through 11.13, update to version 11.14.1 or later. For Asterisk Open Source versions 12.x through 12.6, update to version 12.7.1 or later. For Asterisk Open Source versions 13.x through 13.0.0, update to version 13.0.1 or later. For Certified Asterisk versions 1.8.28 through 1.8.28-cert2, update to version 1.8.28-cert3 or later. For Certified Asterisk versions 11.6 through 11.6-cert7, update to version 11.6-cert8 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-8412

DLA-455-1

Affected Products

Asterisk

References · 6

• https://osv.dev/vulnerability/CVE-2014-8412 · Vendor Advisory
• http://downloads.asterisk.org/pub/security/AST-2014-012.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8412 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-8412 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-8412 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8412 · Note