Lucene search

MitreCVE-2010-0685

HistoryFeb 23, 2010 - 8:30 p.m.

CVE-2010-0685

2010-02-2320:30:00

mitre

web.nvd.nist.gov

cve-2010-0685

asterisk

open source

vulnerability

dialplan

sip invite

metacharacters

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

AI Score

6.6

Confidence

Low

EPSS

0.009

Percentile

83.2%

JSON

The design of the dialplan functionality in Asterisk Open Source 1.2.x, 1.4.x, and 1.6.x; and Asterisk Business Edition B.x.x and C.x.x, when using the ${EXTEN} channel variable and wildcard pattern matches, allows context-dependent attackers to inject strings into the dialplan using metacharacters that are injected when the variable is expanded, as demonstrated using the Dial application to process a crafted SIP INVITE message that adds an unintended outgoing channel leg. NOTE: it could be argued that this is not a vulnerability in Asterisk, but a class of vulnerabilities that can occur in any program that uses this feature without the associated filtering functionality that is already available.

Affected configurations

Nvd

Node

digiumasteriskMatch1.2.0

digiumasteriskMatch1.2.0beta1

digiumasteriskMatch1.2.0beta2

digiumasteriskMatch1.2.0rc1

digiumasteriskMatch1.2.0rc2

digiumasteriskMatch1.2.1

digiumasteriskMatch1.2.2

digiumasteriskMatch1.2.2netsec

digiumasteriskMatch1.2.3

digiumasteriskMatch1.2.3netsec

digiumasteriskMatch1.2.6

digiumasteriskMatch1.2.7

digiumasteriskMatch1.2.8

digiumasteriskMatch1.2.9

digiumasteriskMatch1.2.10

digiumasteriskMatch1.2.10netsec

digiumasteriskMatch1.2.11

digiumasteriskMatch1.2.11netsec

digiumasteriskMatch1.2.12

digiumasteriskMatch1.2.12netsec

digiumasteriskMatch1.2.12.1

digiumasteriskMatch1.2.12.1netsec

digiumasteriskMatch1.2.13

digiumasteriskMatch1.2.13netsec

digiumasteriskMatch1.2.14

digiumasteriskMatch1.2.15

digiumasteriskMatch1.2.15netsec

digiumasteriskMatch1.2.16

digiumasteriskMatch1.2.16netsec

digiumasteriskMatch1.2.17

digiumasteriskMatch1.2.17netsec

digiumasteriskMatch1.2.18

digiumasteriskMatch1.2.18netsec

digiumasteriskMatch1.2.19

digiumasteriskMatch1.2.19netsec

digiumasteriskMatch1.2.20

digiumasteriskMatch1.2.20netsec

digiumasteriskMatch1.2.21

digiumasteriskMatch1.2.21netsec

digiumasteriskMatch1.2.21.1

digiumasteriskMatch1.2.21.1netsec

digiumasteriskMatch1.2.22

digiumasteriskMatch1.2.22netsec

digiumasteriskMatch1.2.23

digiumasteriskMatch1.2.23netsec

digiumasteriskMatch1.2.24

digiumasteriskMatch1.2.24netsec

digiumasteriskMatch1.2.25

digiumasteriskMatch1.2.25netsec

digiumasteriskMatch1.2.26

digiumasteriskMatch1.2.26netsec

digiumasteriskMatch1.2.26.1

digiumasteriskMatch1.2.26.1netsec

digiumasteriskMatch1.2.26.2

digiumasteriskMatch1.2.26.2netsec

digiumasteriskMatch1.2.27

digiumasteriskMatch1.2.28

digiumasteriskMatch1.2.28.1

digiumasteriskMatch1.2.29

digiumasteriskMatch1.2.30

digiumasteriskMatch1.2.30.1

digiumasteriskMatch1.2.30.2

digiumasteriskMatch1.2.30.3

digiumasteriskMatch1.2.30.4

digiumasteriskMatch1.2.31

digiumasteriskMatch1.2.31.1

digiumasteriskMatch1.2.32

digiumasteriskMatch1.2.33

digiumasteriskMatch1.2.34

digiumasteriskMatch1.2.35

digiumasteriskMatch1.2.36

digiumasteriskMatch1.4.0

digiumasteriskMatch1.4.1

digiumasteriskMatch1.4.2

digiumasteriskMatch1.4.3

digiumasteriskMatch1.4.4

digiumasteriskMatch1.4.5

digiumasteriskMatch1.4.6

digiumasteriskMatch1.4.7

digiumasteriskMatch1.4.8

digiumasteriskMatch1.4.9

digiumasteriskMatch1.4.10

digiumasteriskMatch1.4.11

digiumasteriskMatch1.4.12

digiumasteriskMatch1.4.13

digiumasteriskMatch1.4.14

digiumasteriskMatch1.4.15

digiumasteriskMatch1.4.16

digiumasteriskMatch1.4.17

digiumasteriskMatch1.4.18

digiumasteriskMatch1.4.19

digiumasteriskMatch1.4.20

digiumasteriskMatch1.4.21

digiumasteriskMatch1.4.22

digiumasteriskMatch1.4.23

digiumasteriskMatch1.4.24

digiumasteriskMatch1.4.25

digiumasteriskMatch1.4.26

digiumasteriskMatch1.4.27

digiumasteriskMatch1.6.0

digiumasteriskMatch1.6.1

digiumasteriskMatch1.6.1.0

digiumasteriskMatch1.6.2.0

Node

digiumasteriskMatchb.1.3.2-business

digiumasteriskMatchb.1.3.3-business

digiumasteriskMatchb.2.2.0-business

digiumasteriskMatchb.2.2.1-business

digiumasteriskMatchb.2.3.1-business

digiumasteriskMatchb.2.3.2-business

digiumasteriskMatchb.2.3.3-business

digiumasteriskMatchb.2.3.4-business

digiumasteriskMatchb.2.3.5-business

digiumasteriskMatchb.2.3.6-business

digiumasteriskMatchb.2.5.0-business

digiumasteriskMatchb.2.5.1-business

digiumasteriskMatchb.2.5.2-business

digiumasteriskMatchb.2.5.3-business

digiumasteriskMatchc.1.0beta7business

digiumasteriskMatchc.1.0beta8business

digiumasteriskMatchc.1.6-business

digiumasteriskMatchc.1.6.1-business

digiumasteriskMatchc.1.6.2-business

digiumasteriskMatchc.1.8.0-business

digiumasteriskMatchc.1.8.1-business

digiumasteriskMatchc.2.3-business

digiumasteriskMatchc.3.0-business

VendorProductVersionCPE
digiumasterisk1.2.0cpe:2.3:a:digium:asterisk:1.2.0:*:*:*:*:*:*:*
digiumasterisk1.2.0cpe:2.3:a:digium:asterisk:1.2.0:beta1:*:*:*:*:*:*
digiumasterisk1.2.0cpe:2.3:a:digium:asterisk:1.2.0:beta2:*:*:*:*:*:*
digiumasterisk1.2.0cpe:2.3:a:digium:asterisk:1.2.0:rc1:*:*:*:*:*:*
digiumasterisk1.2.0cpe:2.3:a:digium:asterisk:1.2.0:rc2:*:*:*:*:*:*
digiumasterisk1.2.1cpe:2.3:a:digium:asterisk:1.2.1:*:*:*:*:*:*:*
digiumasterisk1.2.2cpe:2.3:a:digium:asterisk:1.2.2:*:*:*:*:*:*:*
digiumasterisk1.2.2cpe:2.3:a:digium:asterisk:1.2.2:netsec:*:*:*:*:*:*
digiumasterisk1.2.3cpe:2.3:a:digium:asterisk:1.2.3:*:*:*:*:*:*:*
digiumasterisk1.2.3cpe:2.3:a:digium:asterisk:1.2.3:netsec:*:*:*:*:*:*

Vendor	Product	Version	CPE
digium	asterisk	1.2.0	cpe:2.3:a:digium:asterisk:1.2.0:::::::*
digium	asterisk	1.2.0	cpe:2.3:a:digium:asterisk:1.2.0:beta1::::::
digium	asterisk	1.2.0	cpe:2.3:a:digium:asterisk:1.2.0:beta2::::::
digium	asterisk	1.2.0	cpe:2.3:a:digium:asterisk:1.2.0:rc1::::::
digium	asterisk	1.2.0	cpe:2.3:a:digium:asterisk:1.2.0:rc2::::::
digium	asterisk	1.2.1	cpe:2.3:a:digium:asterisk:1.2.1:::::::*
digium	asterisk	1.2.2	cpe:2.3:a:digium:asterisk:1.2.2:::::::*
digium	asterisk	1.2.2	cpe:2.3:a:digium:asterisk:1.2.2:netsec::::::
digium	asterisk	1.2.3	cpe:2.3:a:digium:asterisk:1.2.3:::::::*
digium	asterisk	1.2.3	cpe:2.3:a:digium:asterisk:1.2.3:netsec::::::

Rows per page:

1-10 of 1261

References

downloads.digium.com/pub/security/AST-2010-002.html

lists.fedoraproject.org/pipermail/package-announce/2010-March/037679.html

secunia.com/advisories/38641

secunia.com/advisories/39096

svn.asterisk.org/svn/asterisk/branches/1.2/README-SERIOUSLY.bestpractices.txt

www.securityfocus.com/archive/1/509608/100/0/threaded

www.securitytracker.com/id?1023637

www.vupen.com/english/advisories/2010/0439

exchange.xforce.ibmcloud.com/vulnerabilities/56397

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

AI Score

6.6

Confidence

Low

EPSS

0.009

Percentile

83.2%

JSON

Related for CVE-2010-0685