PT-2019-15535 · Sangoma+1 · Asterisk+1

Eliel Sardañons · Published 2019-11-22 · Updated 2022-06-03 · CVE-2019-18610

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sangoma Asterisk versions 13.x through 17.x Certified Asterisk versions 13.21 through 13.21-cert4

Description An issue was discovered in the manager.c file, allowing a remote authenticated Asterisk Manager Interface (AMI) user without system authorization to execute arbitrary system commands using a specially crafted Originate AMI request.

Recommendations For Sangoma Asterisk versions 13.x through 17.x, consider disabling the Originate AMI request functionality until a patch is available. For Certified Asterisk versions 13.21 through 13.21-cert4, restrict access to the AMI interface to minimize the risk of exploitation. As a temporary workaround, consider limiting the privileges of authenticated AMI users to prevent the execution of arbitrary system commands.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

ALT-PU-2020-2313

CVE-2019-18610

DLA-2017-1

DLA-2969-1

Affected Products

Alt Linux

Asterisk

References · 43

• https://osv.dev/vulnerability/DLA-2017-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15639 · Security Note
• https://bdu.fstec.ru/vul/2022-01086 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15297 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37325 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42705 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18610 · Vendor Advisory
• https://asterisk.org/downloads/security-advisories · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/675928 · Security Note
• https://bdu.fstec.ru/vul/2022-02209 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-18610 · Security Note
• http://downloads.asterisk.org/pub/security/AST-2019-007.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26651 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18610 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02186 · Security Note