CVE-2014-8412

2014-11-2415:59:00

CWE-264

[email protected]

web.nvd.nist.gov

asterisk

voip

vulnerability

acl bypass

security advisory

6.4 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.004 Low

EPSS

Percentile

73.9%

JSON

The (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 allows remote attackers to bypass the ACL restrictions via a packet with a source IP that does not share the address family as the first ACL entry.

CPENameOperatorVersion
digium:certified_asteriskdigium certified asteriskeq11.6
digium:certified_asteriskdigium certified asteriskeq1.8.28
digium:certified_asteriskdigium certified asteriskeq1.8.28.0
digium:certified_asteriskdigium certified asteriskeq11.6.0
digium:asteriskdigium asterisklt1.8.32.1
digium:asteriskdigium asterisklt11.14.1
digium:asteriskdigium asterisklt12.7.1
digium:asteriskdigium asterisklt13.0.1

CPE	Name	Operator	Version
digium:certified_asterisk	digium certified asterisk	eq	11.6
digium:certified_asterisk	digium certified asterisk	eq	1.8.28
digium:certified_asterisk	digium certified asterisk	eq	1.8.28.0
digium:certified_asterisk	digium certified asterisk	eq	11.6.0
digium:asterisk	digium asterisk	lt	1.8.32.1
digium:asterisk	digium asterisk	lt	11.14.1
digium:asterisk	digium asterisk	lt	12.7.1
digium:asterisk	digium asterisk	lt	13.0.1