Lucene search
HistoryAug 31, 2012 - 2:55 p.m.
CVE-2012-4737
6 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
6.1 Medium
AI Score
Confidence
Low
0.008 Low
EPSS
Percentile
81.8%
channels/chan_iax2.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert7, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 does not enforce ACL rules during certain uses of peer credentials, which allows remote authenticated users to bypass intended outbound-call restrictions by leveraging the availability of these credentials.
Affected configurations
Node
digiumasteriskMatch1.8.0
ORdigiumasteriskMatch1.8.0beta1
ORdigiumasteriskMatch1.8.0beta2
ORdigiumasteriskMatch1.8.0beta3
ORdigiumasteriskMatch1.8.0beta4
ORdigiumasteriskMatch1.8.0beta5
ORdigiumasteriskMatch1.8.0rc2
ORdigiumasteriskMatch1.8.0rc3
ORdigiumasteriskMatch1.8.0rc4
ORdigiumasteriskMatch1.8.0rc5
ORdigiumasteriskMatch1.8.1
ORdigiumasteriskMatch1.8.1rc1
ORdigiumasteriskMatch1.8.1.1
ORdigiumasteriskMatch1.8.1.2
ORdigiumasteriskMatch1.8.2
ORdigiumasteriskMatch1.8.2.1
ORdigiumasteriskMatch1.8.2.2
ORdigiumasteriskMatch1.8.2.3
ORdigiumasteriskMatch1.8.2.4
ORdigiumasteriskMatch1.8.3
ORdigiumasteriskMatch1.8.3rc1
ORdigiumasteriskMatch1.8.3rc2
ORdigiumasteriskMatch1.8.3rc3
ORdigiumasteriskMatch1.8.3.1
ORdigiumasteriskMatch1.8.3.2
ORdigiumasteriskMatch1.8.3.3
ORdigiumasteriskMatch1.8.4
ORdigiumasteriskMatch1.8.4rc1
ORdigiumasteriskMatch1.8.4rc2
ORdigiumasteriskMatch1.8.4rc3
ORdigiumasteriskMatch1.8.4.1
ORdigiumasteriskMatch1.8.4.2
ORdigiumasteriskMatch1.8.4.3
ORdigiumasteriskMatch1.8.4.4
ORdigiumasteriskMatch1.8.5
ORdigiumasteriskMatch1.8.5rc1
ORdigiumasteriskMatch1.8.5.0
ORdigiumasteriskMatch1.8.6.0
ORdigiumasteriskMatch1.8.6.0rc1
ORdigiumasteriskMatch1.8.6.0rc2
ORdigiumasteriskMatch1.8.6.0rc3
ORdigiumasteriskMatch1.8.7.0
ORdigiumasteriskMatch1.8.7.0rc1
ORdigiumasteriskMatch1.8.7.0rc2
ORdigiumasteriskMatch1.8.7.1
ORdigiumasteriskMatch1.8.8.0
ORdigiumasteriskMatch1.8.8.0rc1
ORdigiumasteriskMatch1.8.8.0rc2
ORdigiumasteriskMatch1.8.8.0rc3
ORdigiumasteriskMatch1.8.8.0rc4
ORdigiumasteriskMatch1.8.8.0rc5
ORdigiumasteriskMatch1.8.8.1
ORdigiumasteriskMatch1.8.8.2
ORdigiumasteriskMatch1.8.9.0
ORdigiumasteriskMatch1.8.9.0rc1
ORdigiumasteriskMatch1.8.9.0rc2
ORdigiumasteriskMatch1.8.9.0rc3
ORdigiumasteriskMatch1.8.9.1
ORdigiumasteriskMatch1.8.9.2
ORdigiumasteriskMatch1.8.9.3
ORdigiumasteriskMatch1.8.10.0
ORdigiumasteriskMatch1.8.10.0rc1
ORdigiumasteriskMatch1.8.10.0rc2
ORdigiumasteriskMatch1.8.10.0rc3
ORdigiumasteriskMatch1.8.10.0rc4
ORdigiumasteriskMatch1.8.10.1
ORdigiumasteriskMatch1.8.11.0
ORdigiumasteriskMatch1.8.11.0rc2
ORdigiumasteriskMatch1.8.11.0rc3
ORdigiumasteriskMatch1.8.11.1
ORdigiumasteriskMatch1.8.12
ORdigiumasteriskMatch1.8.12.0
ORdigiumasteriskMatch1.8.12.0rc1
ORdigiumasteriskMatch1.8.12.0rc2
ORdigiumasteriskMatch1.8.12.0rc3
ORdigiumasteriskMatch1.8.13.0
ORdigiumasteriskMatch1.8.13.0rc1
ORdigiumasteriskMatch1.8.13.0rc2
ORdigiumasteriskMatch1.8.13.1
ORdigiumasteriskMatch1.8.14.0rc1
ORdigiumasteriskMatch1.8.14.0rc2
ORdigiumasteriskMatch1.8.14.1
ORdigiumasteriskMatch1.8.15.0
ORdigiumasteriskMatch1.8.15.0rc1
Node
digiumasteriskMatch10.0.0
ORdigiumasteriskMatch10.0.0beta1
ORdigiumasteriskMatch10.0.0beta2
ORdigiumasteriskMatch10.0.0rc1
ORdigiumasteriskMatch10.0.0rc2
ORdigiumasteriskMatch10.0.0rc3
ORdigiumasteriskMatch10.0.1
ORdigiumasteriskMatch10.1.0
ORdigiumasteriskMatch10.1.0rc1
ORdigiumasteriskMatch10.1.0rc2
ORdigiumasteriskMatch10.1.1
ORdigiumasteriskMatch10.1.2
ORdigiumasteriskMatch10.1.3
ORdigiumasteriskMatch10.2.0
ORdigiumasteriskMatch10.2.0rc1
ORdigiumasteriskMatch10.2.0rc2
ORdigiumasteriskMatch10.2.0rc3
ORdigiumasteriskMatch10.2.0rc4
ORdigiumasteriskMatch10.2.1
ORdigiumasteriskMatch10.3.0
ORdigiumasteriskMatch10.3.0rc2
ORdigiumasteriskMatch10.3.0rc3
ORdigiumasteriskMatch10.3.1
ORdigiumasteriskMatch10.4.0
ORdigiumasteriskMatch10.4.0rc1
ORdigiumasteriskMatch10.4.0rc2
ORdigiumasteriskMatch10.4.0rc3
ORdigiumasteriskMatch10.4.1
ORdigiumasteriskMatch10.4.2
ORdigiumasteriskMatch10.5.0
ORdigiumasteriskMatch10.5.0rc1
ORdigiumasteriskMatch10.5.0rc2
ORdigiumasteriskMatch10.5.1
ORdigiumasteriskMatch10.6.0
ORdigiumasteriskMatch10.6.0rc1
ORdigiumasteriskMatch10.6.0rc2
ORdigiumasteriskMatch10.6.1
ORdigiumasteriskMatch10.7.0
ORdigiumasteriskMatch10.7.0rc1
Node
digiumcertified_asteriskMatch1.8.11cert
ORdigiumcertified_asteriskMatch1.8.11cert1
ORdigiumcertified_asteriskMatch1.8.11cert2
ORdigiumcertified_asteriskMatch1.8.11cert3
ORdigiumcertified_asteriskMatch1.8.11cert4
ORdigiumcertified_asteriskMatch1.8.11cert5
ORdigiumcertified_asteriskMatch1.8.11cert6
Node
digiumasteriskMatch10.5.2digiumphones
ORdigiumasteriskMatch10.6.0digiumphones
ORdigiumasteriskMatch10.6.1digiumphones
ORdigiumasteriskMatch10.7.0digiumphones
Node
digiumasteriskMatchc.3.0-business
ORdigiumasteriskMatchc.3.1.0-business
ORdigiumasteriskMatchc.3.1.1-business
ORdigiumasteriskMatchc.3.2.2-business
ORdigiumasteriskMatchc.3.2.3-business
ORdigiumasteriskMatchc.3.3.2-business
ORdigiumasteriskMatchc.3.6.2-business
ORdigiumasteriskMatchc.3.6.3-business
ORdigiumasteriskMatchc.3.6.4-business
ORdigiumasteriskMatchc.3.7.5-business
Related
cve
cve
CVE-2012-4737
2012-08-31 14:55:01
prion
prion
Design/Logic Flaw
2012-08-31 14:55:00
ubuntucve
ubuntucve
CVE-2012-4737
2012-08-31 00:00:00
securityvulns
securityvulns
AST-2012-013: ACL rules ignored when placing outbound calls by certain IAX2 users
2012-09-02 00:00:00
Asterisk security vulnerabilities
2012-09-02 00:00:00
nessus
nessus
Asterisk Peer IAX2 Call Handling ACL Rule Bypass (AST-2012-013)
2012-09-06 00:00:00
FreeBSD : asterisk -- multiple vulnerabilities (4c53f007-f2ed-11e1-a215-14dae9ebcf89)
2012-08-31 00:00:00
Debian DSA-2550-2 : asterisk - several vulnerabilities
2012-09-19 00:00:00
debiancve
debiancve
CVE-2012-4737
2012-08-31 14:55:01
cvelist
cvelist
CVE-2012-4737
2012-08-31 14:00:00
freebsd
freebsd
asterisk -- multiple vulnerabilities
2012-08-30 00:00:00
openvas
openvas
FreeBSD Ports: asterisk
2012-08-30 00:00:00
FreeBSD Ports: asterisk
2012-08-30 00:00:00
Debian Security Advisory DSA 2550-1 (asterisk)
2012-09-23 00:00:00
gentoo
gentoo
Asterisk: Multiple vulnerabilities
2012-09-26 00:00:00
debian
debian
[SECURITY] [DSA 2550-2] asterisk regression update
2012-09-26 16:05:00
[SECURITY] [DSA 2550-1] asterisk security update
2012-09-18 17:18:45
6 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
6.1 Medium
AI Score
Confidence
Low
0.008 Low
EPSS
Percentile
81.8%
Related for NVD:CVE-2012-4737