DEBIAN-CVE-2024-42365

Asterisk is an open source private branch exchange PBX and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with write=originate may change all configuration files in the /etc/asterisk/ directory. Thi...

CVE-2024-42365

Asterisk is an open source private branch exchange PBX and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with write=originate may change all configuration files in the /etc/asterisk/ directory. Thi...

CVE-2024-42365 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan

Asterisk is an open source private branch exchange PBX and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with write=originate may change all configuration files in the /etc/asterisk/ directory. Thi...

CVE-2024-42365

CVE-2024-42365 affects Asterisk prior to 18.24.2, 20.9.2, and 21.4.2 (and their certified-asterisk variants 18.9-cert11 and 20.7-cert2). An AMI user with write=originate can curl remote files and write them to disk, and can also append to existing files via the FILE function inside the SET applic...

CVE-2024-42365 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan

Asterisk is an open source private branch exchange PBX and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with write=originate may change all configuration files in the /etc/asterisk/ directory. Thi...

CVE-2024-42365 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan

Asterisk is an open source private branch exchange PBX and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with write=originate may change all configuration files in the /etc/asterisk/ directory. Thi...

CVE-2024-42365

Asterisk is an open source private branch exchange PBX and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with write=originate may change all configuration files in the /etc/asterisk/ directory. Thi...

CVE-2024-42365

Asterisk is an open source private branch exchange PBX and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with write=originate may change all configuration files in the /etc/asterisk/ directory. Thi...

Asterisk AMI Originate Authenticated RCE

On Asterisk, prior to versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with 'write=originate' may change all configuration files in the '/etc/asterisk/' directory. Writing a new extension can be created which performs a system command to...

ROS-20240807-03

The vulnerability of PJSIPHEADER function of Asterisk and Certified Asterisk IP telephony management systems is related to with operation exceeding the buffer boundaries in memory when processing the update argument. Exploitation of the vulnerability could allow an attacker acting remotely to cau...

Amazon Linux AMI : kernel (ALAS-2024-1945)

The version of kernel installed on the remote host is prior to 4.14.349-188.564. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2024-1945 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of timer for log...

Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2024-041)

The version of docker installed on the remote host is prior to 25.0.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2024-041 advisory. 2025-01-04: CVE-2024-36620 was added to this advisory. 2025-01-04: CVE-2024-36623 was added to this advisory...

Amazon Linux AMI : httpd24 (ALAS-2024-1944)

The version of httpd24 installed on the remote host is prior to 2.4.61-1.103. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2024-1944 advisory. Substitution encoding issue in modrewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts...

CVE-2024-4143

A potential security vulnerability has been identified in certain HP PC products using AMI BIOS, which might allow arbitrary code execution. AMI has released firmware updates to mitigate this vulnerability...

CVE-2024-4143

CVE-2024-4143 concerns HP PC products using AMI BIOS with a Buffer Overflow vulnerability. Red Hat/HP/NVD and CVE records describe a potential arbitrary code execution due to improper input handling in AMI BIOS. Red Hat and CVE records reiterate that AMI has released firmware updates to mitigate ...

CVE-2024-4143 Certain HP PC products using AMI BIOS – Buffer Overflow

A potential security vulnerability has been identified in certain HP PC products using AMI BIOS, which might allow arbitrary code execution. AMI has released firmware updates to mitigate this vulnerability...

CVE-2024-4143 Certain HP PC products using AMI BIOS – Buffer Overflow

A potential security vulnerability has been identified in certain HP PC products using AMI BIOS, which might allow arbitrary code execution. AMI has released firmware updates to mitigate this vulnerability...

Certain HP PC products using AMI BIOS – Buffer Overflow

A potential security vulnerability has been identified in certain HP PC products using AMI BIOS, which might allow arbitrary code execution. AMI has released firmware updates to mitigate this vulnerability. AMI has released updates to mitigate the potential vulnerability. HP has identified affect...

HPESBCR04667 rev.1 - HPE Cray Servers Using AMI MegaRac SPX Software (AMI-SA-2023010), Multiple Vulnerabilities

Potential Security Impact: Local: memory corruption, Buffer Overflow, Null pointer dereference SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Cray XD665 - prior to BMC 1.14 in HPE Cray SC XD665 Firmware Pack 2024.01.00 HPE Cray XD670 - prior to BMC 1.14 in BMC Firmware for HP...

Amazon Linux AMI : kernel (ALAS-2024-1943)

The version of kernel installed on the remote host is prior to 4.14.348-187.565. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1943 advisory. In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Disable kvmclock on all CPUs on shutdown...