CVE-2010-1224: Medium severity Asterisk vulnerability
main/acl.c in Asterisk Open Source 1.6.0.x before 1.6.0.25, 1.6.1.x before 1.6.1.17, and 1.6.2.x before 1.6.2.5 does not properly enforce remote host access controls when CIDR notation "/0" is used in permit= and deny= configuration rules, which causes an improper arithmetic shift and might allow remote attackers to bypass ACL rules and access services from unauthorized hosts.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1224?
CVE-2010-1224 is considered a medium severity vulnerability due to its potential exploitation by unauthorized remote attackers.
How do I fix CVE-2010-1224?
To fix CVE-2010-1224, upgrade to Asterisk versions 1.6.0.25, 1.6.1.17, or 1.6.2.5 or later.
Which versions of Asterisk are affected by CVE-2010-1224?
Asterisk versions prior to 1.6.0.25, 1.6.1.17, and 1.6.2.5 are affected by CVE-2010-1224.
What type of vulnerability is CVE-2010-1224?
CVE-2010-1224 is an access control vulnerability that can allow unauthorized access through misconfigured CIDR notation in settings.
Is CVE-2010-1224 a local or remote vulnerability?
CVE-2010-1224 is a remote vulnerability that could be exploited by attackers over the network.