CVE-2019-18610: Critical severity asterisk vulnerability
An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-18610?
CVE-2019-18610 is a vulnerability discovered in Sangoma Asterisk that allows a remote authenticated user to execute arbitrary system commands.
Which versions of Sangoma Asterisk are affected by CVE-2019-18610?
CVE-2019-18610 affects Sangoma Asterisk versions 13.x, 16.x, 17.x, as well as Certified Asterisk 13.21 through 13.21-cert4.
How severe is CVE-2019-18610?
CVE-2019-18610 has a severity score of 8.8, which is classified as critical.
How can I fix CVE-2019-18610?
To fix CVE-2019-18610, it is recommended to update Sangoma Asterisk to versions 13.29.2, 16.6.2, 17.0.1, or a later release.
Are there any references for CVE-2019-18610?
Yes, you can find references for CVE-2019-18610 at the following links: - [AST-2019-007](http://downloads.asterisk.org/pub/security/AST-2019-007.html) - [Debian LTS Announce](https://lists.debian.org/debian-lts-announce/2019/11/msg00038.html) - [Debian LTS Announce](https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html)