First published: Fri Nov 30 2007(Updated: )
SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Digium Asterisk | >=1.2.0<1.2.25 | |
Digium Asterisk | >=1.4.0<1.4.15 | |
Digium Asterisk | >=b.2.3.0<b.2.3.4 | |
Digium Asterisk | =c.1.0-beta1 | |
Digium Asterisk | =c.1.0-beta2 | |
Digium Asterisk | =c.1.0-beta3 | |
Digium Asterisk | =c.1.0-beta4 | |
Digium Asterisk | =c.1.0-beta5 | |
Debian Debian Linux | =3.1 | |
Debian Debian Linux | =4.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.