CVE-2014-4046: Medium severity Asterisk vulnerability
Published Jun 17, 2014
·Updated
Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action.
Affected Software
54 affected components
Asterisk=11.0.0
Asterisk=11.0.0-beta1
Asterisk=11.0.0-beta2
Asterisk=11.0.0-rc1
Asterisk=11.0.0-rc2
Asterisk=11.0.1
Asterisk=11.0.2
Asterisk=11.1.0
Asterisk=11.1.0-rc1
Asterisk=11.1.0-rc3
Asterisk=11.1.1
Asterisk=11.1.2
Asterisk=11.2.0-rc1
Asterisk=11.2.0-rc2
Asterisk=11.3.0-rc1
Asterisk=11.3.0-rc2
Asterisk=11.4.0
Asterisk=11.4.0-rc1
Asterisk=11.4.0-rc2
Asterisk=11.4.0-rc3
Asterisk=11.5.0
Asterisk=11.5.0-rc1
Asterisk=11.5.0-rc2
Asterisk=11.5.1
Asterisk=11.8.0
Asterisk=11.8.0-rc1
Asterisk=11.8.0-rc2
Asterisk=11.8.0-rc3
Asterisk=11.8.1
Asterisk=11.9.0
Asterisk=11.9.0-rc1
Asterisk=11.9.0-rc2
Asterisk=11.10.0
Asterisk=11.10.0-rc1
Asterisk=12.0.0
Asterisk=12.1.0
Asterisk=12.1.0-rc1
Asterisk=12.1.0-rc2
Asterisk=12.1.0-rc3
Asterisk=12.1.1
Asterisk=12.2.0
Asterisk=12.2.0-rc1
Asterisk=12.2.0-rc2
Asterisk=12.2.0-rc3
Asterisk=12.3.0
Asterisk=12.3.0-rc1
Asterisk=12.3.0-rc2
Digium Asterisk Appliance Developer Kit=11.6-cert1
Digium Asterisk Appliance Developer Kit=11.6-cert1_rc1
Digium Asterisk Appliance Developer Kit=11.6-cert1_rc2
Digium Asterisk Appliance Developer Kit=11.6-cert2
Digium Asterisk Appliance Developer Kit=11.6.0
Digium Asterisk Appliance Developer Kit=11.6.0-rc1
Digium Asterisk Appliance Developer Kit=11.6.0-rc2
Remediation
Patch Available
Event History
Jun 17, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-4046?
The severity of CVE-2014-4046 is classified as high due to the ability of authenticated users to execute arbitrary shell commands.
2
How do I fix CVE-2014-4046?
To fix CVE-2014-4046, upgrade to Asterisk version 11.10.1 or 12.3.1 or later.
3
Who is affected by CVE-2014-4046?
CVE-2014-4046 affects Asterisk Open Source versions prior to 11.10.1 and 12.3.1.
4
What types of actions can be exploited in CVE-2014-4046?
CVE-2014-4046 allows exploitation via the MixMonitor action, enabling arbitrary command execution.
5
What are the potential impacts of CVE-2014-4046?
The potential impacts of CVE-2014-4046 include loss of data integrity, unauthorized access, and complete system compromise.