Asterisk cdr_addon_mysql插件SQL注入漏洞

CVECAN ID: CVE-2007-5488 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 Asterisk的cdraddonmysql模块实现上存在输入验证漏洞，远程攻击者可能利用此漏洞非授权操作数据库。 Asterisk的cdraddonmysql模块在插入记录时没有正确地转义指定呼叫的源和目标号码，发送给运行了该模块的Asterisk系统特制的目标号码可能导致SQL注入攻击。如果用户在使用实时数据的话，由于数据可能与插入呼叫记录处于同一数据库中，因此可能会导致各种数据破坏和失效等问题。 Asterisk Asterisk-Addons 1.4.x...

AST-2007-023 - SQL Injection Vulnerabilty in cdr_addon_mysql

Asterisk Project Security Advisory - AST-2007-023 +------------------------------------------------------------------------+ | Product | Asterisk-Addons | |--------------------+---------------------------------------------------| | Summary | SQL Injection Vulnerability in cdraddonmysql |...

CVE-2007-5488

Multiple SQL injection vulnerabilities in cdraddonmysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the 1 source and 2 destination numbers, and probably 3 SIP URI, when inserting a record...

CVE-2007-5488

Multiple SQL injection vulnerabilities in cdraddonmysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the 1 source and 2 destination numbers, and probably 3 SIP URI, when inserting a record...

Sql injection

Multiple SQL injection vulnerabilities in cdraddonmysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the 1 source and 2 destination numbers, and probably 3 SIP URI, when inserting a record...

CVE-2007-5488

CVE-2007-5488 concerns the Asterisk-Addons cdr_addon_mysql module, where the cdr_addon_mysql component fails to escape the source and destination numbers (and possibly SIP URI) when inserting a record. This leads to SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQ...

CVE-2007-5488

Multiple SQL injection vulnerabilities in cdraddonmysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the 1 source and 2 destination numbers, and probably 3 SIP URI, when inserting a record...

openSUSE 10 Security Update : asterisk (asterisk-1676)

A security problem was fixed in the IAX2 channel driver of Asterisk that could be used by remote users to execute code or at least crash Asterisk. This issue is tracked by the Mitre CVE ID CVE-2006-2898. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks ...

openSUSE 10 Security Update : asterisk (asterisk-2272)

This update fixes 2 security problem in the PBX software Asterisk. CVE-2006-5444: Integer overflow in the getinput function in the Skinny channel driver chanskinny.c as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integ...

openSUSE 10 Security Update : asterisk (asterisk-3977)

This update fixes multiple bugs in asterisk that allowed remote attackers to crash the asterisk server or even execute arbitrary code CVE-2007-3762, CVE-2007-3763, CVE-2007-3764. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE 10 Security Update : asterisk (asterisk-3543)

This update fixes multiple bugs that allowed attackers to remotely crash asterisk or cause an information leak CVE-2007-1561, CVE-2007-1594, CVE-2007-1595, CVE-2007-2297, CVE-2007-2488. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin wer...

Asterisk asterisk-addons 1.2.71.4.3 - CDR_ADDON_MYSQL Module SQL Injection

Asterisk asterisk-addons 1.2.71.4.3 - CDRADDONMYSQL Module SQL Injection source: https://www.securityfocus.com/bid/26095/info Asterisk 'asterisk-addons' package is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query...

Asterisk 'asterisk-addons' 1.2.7/1.4.3 - CDR_ADDON_MYSQL Module SQL Injection

source: https://www.securityfocus.com/bid/26095/info Asterisk 'asterisk-addons' package is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

CVE-2007-5358

Multiple buffer overflows in the voicemail functionality in Asterisk 1.4.x before 1.4.13, when using IMAP storage, might allow 1 remote attackers to execute arbitrary code via a long combination of Content-type and Content-description headers, or 2 local users to execute arbitrary code via a long...

Buffer overflow

Multiple buffer overflows in the voicemail functionality in Asterisk 1.4.x before 1.4.13, when using IMAP storage, might allow 1 remote attackers to execute arbitrary code via a long combination of Content-type and Content-description headers, or 2 local users to execute arbitrary code via a long...

CVE-2007-5358

Multiple buffer overflows in the voicemail functionality in Asterisk 1.4.x before 1.4.13, when using IMAP storage, might allow 1 remote attackers to execute arbitrary code via a long combination of Content-type and Content-description headers, or 2 local users to execute arbitrary code via a long...

DEBIAN-CVE-2007-5358

Multiple buffer overflows in the voicemail functionality in Asterisk 1.4.x before 1.4.13, when using IMAP storage, might allow 1 remote attackers to execute arbitrary code via a long combination of Content-type and Content-description headers, or 2 local users to execute arbitrary code via a long...

CVE-2007-5358

Multiple buffer overflows in the voicemail functionality in Asterisk 1.4.x before 1.4.13, when using IMAP storage, might allow 1 remote attackers to execute arbitrary code via a long combination of Content-type and Content-description headers, or 2 local users to execute arbitrary code via a long...

CVE-2007-5358

CVE-2007-5358 affects Asterisk 1.4.x (before 1.4.13) voicemail functionality when using IMAP storage. The issue is described as multiple buffer overflows in voicemail handling, potentially allowing arbitrary code execution. Two attack vectors are noted: (1) remote attackers could execute arbitrar...

CVE-2007-5358

Multiple buffer overflows in the voicemail functionality in Asterisk 1.4.x before 1.4.13, when using IMAP storage, might allow 1 remote attackers to execute arbitrary code via a long combination of Content-type and Content-description headers, or 2 local users to execute arbitrary code via a long...