CVE-2017-14100

CVE-2017-14100 is a remote command execution vulnerability in Asterisk versions: 11.x before 11.25.2, 13.x before 13.17.1, 14.x before 14.6.1, and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5. It is caused by the app_minivm module’s externnotify option used by the Minivm...

CVE-2017-14098

CVE-2017-14098 affects the Asterisk pjsip channel driver (res_pjsip). A specially crafted tel URI in a From, To, or Contact header can cause Asterisk to crash. Affected versions are Asterisk 13.x prior to 13.17.1 and 14.x prior to 14.6.1. The vulnerability is demonstrated by crash behavior withou...

CVE-2017-14098

In the pjsip channel driver respjsip in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, or Contact header could cause Asterisk to crash...

CVE-2017-14100

In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command execution is possible. The appminivm module has an "externnotify" program configuration option that is executed by the...

CVE-2017-14100

In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command execution is possible. The appminivm module has an "externnotify" program configuration option that is executed by the...

PT-2017-13249

Name of the Vulnerable Software and Affected Versions Asterisk versions 13.x through 13.17.0 Asterisk versions 14.x through 14.6.0 Description The issue arises from a carefully crafted tel URI in a From, To, or Contact header, which could cause Asterisk to crash. Recommendations For Asterisk...

CVE-2017-14098: Improper Input Validation

In the pjsip channel driver respjsip in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, or Contact header could cause Asterisk to crash...

CVE-2017-14099: Exposure of Sensitive Information to an Unauthorized Actor

In res/resrtpasterisk.c in Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized data disclosure media takeover in the RTP stack is possible with careful timing by an attacker. The...

PT-2017-13250

Name of the Vulnerable Software and Affected Versions Asterisk versions 11.x through 11.25.1 Asterisk versions 13.x through 13.17.0 Asterisk versions 14.x through 14.6.0 Certified Asterisk versions 11.x through 11.6-cert16 Certified Asterisk versions 13.x through 13.13-cert4 Description The issue...

CVE-2017-14100: Improper Neutralization of Special Elements used in an OS Command

In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command execution is possible. The appminivm module has an "externnotify" program configuration option that is executed by the...

Digium Asterisk Open Source and Certified Asterisk Session Hijacking Vulnerability

Digium Asterisk Open Source and Certified Asterisk are both open source telephone exchange PBX system software from Digium, Inc. in the United States. The software supports voicemail, multi-party voice conferencing, and interactive voice response IVR. A security vulnerability exists in Asterisk...

Asterisk Multiple Vulnerabilities (Aug 2017)

Asterisk is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:digium:asterisk"; if description...

Digium Asterisk Open Source and Certified Asterisk Arbitrary Command Execution Vulnerabilities

Digium Asterisk Open Source and Certified Asterisk are both open source telephone exchange PBX system software from Digium, Inc. in the United States. The software supports voicemail, multi-party voice conferencing, and interactive voice response IVR. There are security vulnerabilities in Asteris...

Asterisk DoS Vulnerability (AST-2017-007)

Asterisk is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:digium:asterisk";...

Digium Asterisk Denial of Service Vulnerability (CNVD-2017-30817)

Digium Asterisk is a set of open source telephone exchange PBX system software from Digium, USA. The software supports voicemail , multi-party voice conferencing , interactive voice response IVR , etc. pjsip channel driver respjsip is one of the pjsip driver . A security vulnerability exists in t...

asterisk -- RTP/RTCP information leak

The Asterisk project reports: This is a follow up advisory to AST-2017-005. Insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the "nat" and "symmetricrtp" options allow redirecting where Asterisk sends the next RTCP report. The RTP stream...

asterisk -- Remote Crash Vulerability in res_pjsip

The Asterisk project reports: A carefully crafted URI in a From, To or Contact header could cause Asterisk to crash...

asterisk -- Unauthorized data disclosure and shell access command injection in app_minivm

The Asterisk project reports: AST-2017-005 - A change was made to the strict RTP support in the RTP stack to better tolerate late media when a reinvite occurs. When combined with the symmetric RTP support this introduced an avenue where media could be hijacked. Instead of only learning a new...

Unauthorized Access Vulnerability in Digital Programmable Subscriber Switch of NSN9000i Series IPPBX System of Shenzhen Guowei Saina Technology Co.

NSN9000i series IPPBX system is a new-generation hybrid IPPBX system developed by Xena Technology based on the latest IP technology and domestic market. The system combines the digital program-controlled subscriber switch platform developed by SANA Technology and the popular Asterisk application...

Asterisk Gather Credentials

This module retrieves SIP and IAX2 user extensions and credentials from Asterisk Call Manager service. Valid manager credentials are required. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...