PT-2014-8509 · Sangoma · Asterisk

Jonathan Rose · Published 2014-11-24 · Updated 2019-07-16 · CVE-2014-8413

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 12.x through 12.7.0 Asterisk Open Source versions 13.x through 13.0.0

Description The issue concerns the res pjsip acl module, which fails to properly create and load ACLs defined in pjsip.conf at startup. This allows remote attackers to bypass intended PJSIP ACL rules.

Recommendations For Asterisk Open Source versions 12.x through 12.7.0, update to version 12.7.1 or later. For Asterisk Open Source versions 13.x through 13.0.0, update to version 13.0.1 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-8413

Affected Products

Asterisk

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-8413 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-8413 · Vendor Advisory
• http://downloads.asterisk.org/pub/security/AST-2014-013.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-8413 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-8413 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8413 · Note