CVE-2012-2414: Medium severity asterisk vulnerability

Published Apr 30, 2012

Updated

main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements, which allows remote authenticated users to execute arbitrary commands via (1) the originate action in the MixMonitor application, (2) the SHELL and EVAL functions in the GetVar manager action, or (3) the SHELL and EVAL functions in the Status manager action.

Affected Software

153 affected components

Asterisk Open Source=1.6.2.0

Asterisk Open Source=1.6.2.0-rc2

Asterisk Open Source=1.6.2.0-rc3

Asterisk Open Source=1.6.2.0-rc4

Asterisk Open Source=1.6.2.0-rc5

Asterisk Open Source=1.6.2.0-rc6

Asterisk Open Source=1.6.2.0-rc7

Asterisk Open Source=1.6.2.0-rc8

Asterisk Open Source=1.6.2.1

Asterisk Open Source=1.6.2.1-rc1

Asterisk Open Source=1.6.2.2

Asterisk Open Source=1.6.2.3-rc2

Asterisk Open Source=1.6.2.4

Asterisk Open Source=1.6.2.5

Asterisk Open Source=1.6.2.6

Asterisk Open Source=1.6.2.6-rc1

Asterisk Open Source=1.6.2.6-rc2

Asterisk Open Source=1.6.2.7

Asterisk Open Source=1.6.2.7-rc1

Asterisk Open Source=1.6.2.7-rc2

Asterisk Open Source=1.6.2.7-rc3

Asterisk Open Source=1.6.2.8

Asterisk Open Source=1.6.2.8-rc1

Asterisk Open Source=1.6.2.9

Asterisk Open Source=1.6.2.9-rc1

Asterisk Open Source=1.6.2.9-rc2

Asterisk Open Source=1.6.2.9-rc3

Asterisk Open Source=1.6.2.10

Asterisk Open Source=1.6.2.10-rc1

Asterisk Open Source=1.6.2.10-rc2

Asterisk Open Source=1.6.2.11

Asterisk Open Source=1.6.2.11-rc1

Asterisk Open Source=1.6.2.11-rc2

Asterisk Open Source=1.6.2.12

Asterisk Open Source=1.6.2.12-rc1

Asterisk Open Source=1.6.2.13

Asterisk Open Source=1.6.2.14

Asterisk Open Source=1.6.2.14-rc1

Asterisk Open Source=1.6.2.15

Asterisk Open Source=1.6.2.15-rc1

Asterisk Open Source=1.6.2.15.1

Asterisk Open Source=1.6.2.16

Asterisk Open Source=1.6.2.16-rc1

Asterisk Open Source=1.6.2.16.1

Asterisk Open Source=1.6.2.16.2

Asterisk Open Source=1.6.2.17

Asterisk Open Source=1.6.2.17-rc1

Asterisk Open Source=1.6.2.17-rc2

Asterisk Open Source=1.6.2.17-rc3

Asterisk Open Source=1.6.2.17.1

Asterisk Open Source=1.6.2.17.2

Asterisk Open Source=1.6.2.17.3

Asterisk Open Source=1.6.2.18

Asterisk Open Source=1.6.2.18-rc1

Asterisk Open Source=1.6.2.18.1

Asterisk Open Source=1.6.2.18.2

Asterisk Open Source=1.6.2.19

Asterisk Open Source=1.6.2.19-rc1

Asterisk Open Source=1.6.2.20

Asterisk Open Source=1.6.2.21

Asterisk Open Source=1.6.2.22

Asterisk Open Source=1.6.2.23

Asterisk Open Source=1.8.0

Asterisk Open Source=1.8.0-beta1

Asterisk Open Source=1.8.0-beta2

Asterisk Open Source=1.8.0-beta3

Asterisk Open Source=1.8.0-beta4

Asterisk Open Source=1.8.0-beta5

Asterisk Open Source=1.8.0-rc2

Asterisk Open Source=1.8.0-rc3

Asterisk Open Source=1.8.0-rc4

Asterisk Open Source=1.8.0-rc5

Asterisk Open Source=1.8.1

Asterisk Open Source=1.8.1-rc1

Asterisk Open Source=1.8.1.1

Asterisk Open Source=1.8.1.2

Asterisk Open Source=1.8.2

Asterisk Open Source=1.8.2-rc1

Asterisk Open Source=1.8.2.1

Asterisk Open Source=1.8.2.2

Asterisk Open Source=1.8.2.3

Asterisk Open Source=1.8.2.4

Asterisk Open Source=1.8.3

Asterisk Open Source=1.8.3-rc1

Asterisk Open Source=1.8.3-rc2

Asterisk Open Source=1.8.3-rc3

Asterisk Open Source=1.8.3.1

Asterisk Open Source=1.8.3.2

Asterisk Open Source=1.8.3.3

Asterisk Open Source=1.8.4

Asterisk Open Source=1.8.4-rc1

Asterisk Open Source=1.8.4-rc2

Asterisk Open Source=1.8.4-rc3

Asterisk Open Source=1.8.4.1

Asterisk Open Source=1.8.4.2

Asterisk Open Source=1.8.4.3

Asterisk Open Source=1.8.4.4

Asterisk Open Source=1.8.5-rc1

Asterisk Open Source=1.8.5.0

Asterisk Open Source=1.8.6.0

Asterisk Open Source=1.8.6.0-rc1

Asterisk Open Source=1.8.6.0-rc2

Asterisk Open Source=1.8.6.0-rc3

Asterisk Open Source=1.8.7.0

Asterisk Open Source=1.8.7.0-rc1

Asterisk Open Source=1.8.7.0-rc2

Asterisk Open Source=1.8.7.1

Asterisk Open Source=1.8.7.2

Asterisk Open Source=1.8.8.0

Asterisk Open Source=1.8.8.0-rc1

Asterisk Open Source=1.8.8.0-rc2

Asterisk Open Source=1.8.8.0-rc3

Asterisk Open Source=1.8.8.0-rc4

Asterisk Open Source=1.8.8.0-rc5

Asterisk Open Source=1.8.8.1

Asterisk Open Source=1.8.8.2

Asterisk Open Source=1.8.9.0

Asterisk Open Source=1.8.9.0-rc1

Asterisk Open Source=1.8.9.0-rc2

Asterisk Open Source=1.8.9.0-rc3

Asterisk Open Source=1.8.9.1

Asterisk Open Source=1.8.9.2

Asterisk Open Source=1.8.9.3

Asterisk Open Source=1.8.10.0

Asterisk Open Source=1.8.10.0-rc1

Asterisk Open Source=1.8.10.0-rc2

Asterisk Open Source=1.8.10.0-rc3

Asterisk Open Source=1.8.10.0-rc4

Asterisk Open Source=1.8.10.1

Asterisk Open Source=1.8.11.0-rc2

Asterisk Open Source=1.8.11.0-rc3

Asterisk Open Source=10.0.0

Asterisk Open Source=10.0.0-beta1

Asterisk Open Source=10.0.0-beta2

Asterisk Open Source=10.0.0-rc1

Asterisk Open Source=10.0.0-rc2

Asterisk Open Source=10.0.0-rc3

Asterisk Open Source=10.0.1

Asterisk Open Source=10.1.0

Asterisk Open Source=10.1.0-rc1

Asterisk Open Source=10.1.0-rc2

Asterisk Open Source=10.1.1

Asterisk Open Source=10.1.2

Asterisk Open Source=10.1.3

Asterisk Open Source=10.2.0

Asterisk Open Source=10.2.0-rc1

Asterisk Open Source=10.2.0-rc2

Asterisk Open Source=10.2.0-rc3

Asterisk Open Source=10.2.0-rc4

Asterisk Open Source=10.2.1

Asterisk Open Source=10.3.0

Asterisk Open Source=10.3.0-rc2

Asterisk Open Source=10.3.0-rc3

Remediation

Patch Available

http://downloads.asterisk.org/pub/security/AST-2012-004.html

Event History

Apr 30, 2012

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-2414?

CVE-2012-2414 is classified as a medium severity vulnerability.

How do I fix CVE-2012-2414?

To fix CVE-2012-2414, upgrade to Asterisk version 1.6.2.24, 1.8.11.1, or 10.3.1 or later.

What type of vulnerability is CVE-2012-2414?

CVE-2012-2414 is an authorization vulnerability in the Manager Interface of Asterisk.

Who is affected by CVE-2012-2414?

CVE-2012-2414 affects Asterisk Open Source versions 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1.

What impact does CVE-2012-2414 have?

CVE-2012-2414 allows remote authenticated users to bypass authorization checks, which may lead to unauthorized command execution.