{"id": "SECURITYVULNS:DOC:28271", "bulletinFamily": "software", "title": "AST-2012-011: Remote crash vulnerability in voice mail application", "description": " Asterisk Project Security Advisory - AST-2012-011\r\n\r\n Product Asterisk \r\n Summary Remote crash vulnerability in voice mail application \r\n Nature of Advisory Denial of Service \r\n Susceptibility Remote authenticated sessions \r\n Severity Moderate \r\n Exploits Known No \r\n Reported On June 13, 2012 \r\n Reported By Nicolas Bouliane - Avencall Security Labs \r\n Posted On June 27, 2012 \r\n Last Updated On July 5, 2012 \r\n Advisory Contact Kinsey Moore <kmoore@digium.com> \r\n CVE Name CVE-2012-3812 \r\n\r\n Description If a single voicemail account is manipulated by two parties \r\n simultaneously, a condition can occur where memory is freed \r\n twice causing a crash. \r\n\r\n Resolution Management of the memory in question has been reworked so \r\n that double frees and out of bounds array access do not \r\n occur. Upgrade to the latest release. \r\n\r\n Affected Versions\r\n Product Release Series \r\n Asterisk Open Source 1.8.x 1.8.11 and newer \r\n Asterisk Open Source 10.x 10.3 and newer \r\n Certified Asterisk 1.8.11-certx All versions \r\n Asterisk Digiumphones 10.x.x-digiumphones All versions \r\n\r\n Corrected In\r\n Product Release \r\n Asterisk Open Source 1.8.13.1, 10.5.2 \r\n Certified Asterisk 1.8.11-cert4 \r\n Asterisk Digiumphones 10.5.2-digiumphones \r\n\r\n Patches \r\n URL Revision \r\n http://downloads.asterisk.org/pub/security/AST-2012-011-1.8.diff Asterisk \r\n 1.8, \r\n Certified \r\n Asterisk \r\n http://downloads.asterisk.org/pub/security/AST-2012-011-10.diff Asterisk 10, \r\n Asterisk \r\n Digiumphones \r\n\r\n Links https://issues.asterisk.org/jira/browse/ASTERISK-20052 \r\n\r\n Asterisk Project Security Advisories are posted at \r\n http://www.asterisk.org/security \r\n \r\n This document may be superseded by later versions; if so, the latest \r\n version will be posted at \r\n http://downloads.digium.com/pub/security/AST-2012-011.pdf and \r\n http://downloads.digium.com/pub/security/AST-2012-011.html \r\n\r\n Revision History\r\n Date Editor Revisions Made \r\n 06/27/2012 Kinsey Moore Initial Release \r\n\r\n Asterisk Project Security Advisory - AST-2012-011\r\n Copyright (c) 2012 Digium, Inc. All Rights Reserved.\r\n Permission is hereby granted to distribute and publish this advisory in its\r\n original, unaltered form.\r\n", "published": "2012-07-11T00:00:00", "modified": "2012-07-11T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:28271", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2012-3812"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:45", "edition": 1, "viewCount": 1, "enchantments": {"score": {"value": 6.1, "vector": "NONE", "modified": "2018-08-31T11:10:45", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2012-3812"]}, {"type": "freebsd", "idList": ["4C1AC2DD-C788-11E1-BE25-14DAE9EBCF89"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:12469"]}, {"type": "nessus", "idList": ["ASTERISK_AST_2012_011.NASL", "FEDORA_2012-10324.NASL", "GENTOO_GLSA-201209-15.NASL", "DEBIAN_DSA-2550.NASL", "FREEBSD_PKG_4C1AC2DDC78811E1BE2514DAE9EBCF89.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:136141256231072441", "OPENVAS:72408", "OPENVAS:72449", "OPENVAS:71526", "OPENVAS:72441", "OPENVAS:864554", "OPENVAS:136141256231071526", "OPENVAS:1361412562310864554", "OPENVAS:136141256231072449", "OPENVAS:136141256231072408"]}, {"type": "debian", "idList": ["DEBIAN:DSA-2550-2:6ADB9", "DEBIAN:DSA-2550-1:D149A"]}, {"type": "gentoo", "idList": ["GLSA-201209-15"]}], "modified": "2018-08-31T11:10:45", "rev": 2}, "vulnersScore": 6.1}, "affectedSoftware": []}

{"cve": [{"lastseen": "2021-02-02T05:59:52", "description": "Double free vulnerability in apps/app_voicemail.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones allows remote authenticated users to cause a denial of service (daemon crash) by establishing multiple voicemail sessions and accessing both the Urgent mailbox and the INBOX mailbox.", "edition": 4, "cvss3": {}, "published": "2012-07-09T22:55:00", "title": "CVE-2012-3812", "type": "cve", "cwe": ["CWE-399"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2012-3812"], "modified": "2013-04-19T03:24:00", "cpe": ["cpe:/a:digium:asterisk:10.2.1", "cpe:/a:digium:certified_asterisk:1.8.11", "cpe:/a:digium:asterisk:1.8.8.1", "cpe:/a:digium:asterisk:10.4.1", "cpe:/a:digium:asterisk:1.8.4.1", "cpe:/a:digium:asterisk:10.5.0", "cpe:/a:digium:asterisk:1.8.11.0", "cpe:/a:digium:asterisk:10.1.3", "cpe:/a:digium:asterisk:1.8.3.1", "cpe:/a:digium:asterisk:10.3.0", "cpe:/a:digium:asterisk:1.8.0", "cpe:/a:digium:asterisk:1.8.11.1", "cpe:/a:digium:asterisk:1.8.4.2", "cpe:/a:digium:asteriske:1.8.8.0", "cpe:/a:digium:asterisk:1.8.2.3", "cpe:/a:digium:asterisk:1.8.2.1", "cpe:/a:digium:asterisk:1.8.9.2", "cpe:/a:digium:asterisk:1.8.13.0", "cpe:/a:digium:asterisk:1.8.6.0", "cpe:/a:digium:asterisk:1.8.5", "cpe:/a:digium:asterisk:1.8.9.3", "cpe:/a:digium:asterisk:1.8.7.0", "cpe:/a:digium:asterisk:1.8.5.0", "cpe:/a:digium:asterisk:10.3.1", "cpe:/a:digium:asterisk:1.8.4.3", "cpe:/a:digium:asterisk:1.8.4.4", "cpe:/a:digium:asterisk:1.8.2.4", "cpe:/a:digium:asterisk:10.1.0", "cpe:/a:digium:asterisk:10.5.1", "cpe:/a:digium:asterisk:1.8.9.0", "cpe:/a:digium:asterisk:1.8.8.0", "cpe:/a:digium:asterisk:1.8.8.2", "cpe:/a:digium:asterisk:1.8.2.2", "cpe:/a:digium:asterisk:1.8.1.1", "cpe:/a:digium:asterisk:10.0.0", "cpe:/a:digium:asterisk:10.4.0", "cpe:/a:digium:asterisk:10.0.1", "cpe:/a:digium:asterisk:1.8.3.3", "cpe:/a:digium:asterisk:1.8.4", "cpe:/a:digium:asterisk:1.8.3.2", "cpe:/a:digium:asterisk:1.8.1.2", "cpe:/a:digium:asterisk:10.2.0", "cpe:/a:digium:asterisk:1.8.2", "cpe:/a:digium:asterisk:1.8.1", "cpe:/a:digium:asterisk:1.8.3", "cpe:/a:digium:asterisk:1.8.7.1", "cpe:/a:digium:asterisk:10.1.1", "cpe:/a:digium:asteriske:1.8.9.1", "cpe:/a:digium:asterisk:10.4.2", "cpe:/a:digium:asterisk:10.1.2"], "id": "CVE-2012-3812", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3812", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:digium:asterisk:1.8.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:digium:certified_asterisk:1.8.11:cert:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.0.0:rc1:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.8.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.11.0:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.5.0:rc2:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.1.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.3.0:rc2:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.0.0:beta1:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.7.1:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.3.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.1.0:rc1:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.11.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.2.0:*:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.6.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.8.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.5.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.0:rc4:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.0:beta3:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.0.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.0:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.11.1:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asteriske:1.8.8.0:rc4:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.3:rc3:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.5.1:*:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.2.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.1.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.6.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.4.0:rc2:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.5:rc1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.9.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.0.0:beta2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.8.0:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.0.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.9.2:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.0.0:*:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.3.0:rc3:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.2.0:rc2:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.4.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.8.0:rc5:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.7.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.1.0:*:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.1.0:rc2:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.0.0:rc2:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.13.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.5.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.2.0:rc4:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.2.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.1:rc1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:digium:certified_asterisk:1.8.11:cert1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.0:rc5:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.3.0:*:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.4.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.13.0:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.0:beta5:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.0.0:rc3:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.8.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.5:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.13.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.0.0:beta2:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.4.0:rc1:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:certified_asterisk:1.8.11:cert3:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.0:beta4:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.5.0:rc1:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.2.0:rc4:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.9.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.4.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.3:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.3:rc2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.0.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.4:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.9.3:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.3.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.5.0:*:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.4.0:*:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.2.0:rc3:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:digium:certified_asterisk:1.8.11:cert2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.6.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.0:beta2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.4:rc1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.9.0:rc2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.2.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asteriske:1.8.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.7.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.4:rc3:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.4:rc2:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.11.0:rc3:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.2.0:rc1:digiumphones:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:10.0.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.3:rc1:*:*:*:*:*:*", "cpe:2.3:a:digium:asterisk:1.8.9.0:*:*:*:*:*:*:*"]}], "freebsd": [{"lastseen": "2019-05-29T18:33:48", "bulletinFamily": "unix", "cvelist": ["CVE-2012-3812"], "description": "\nAsterisk project reports:\n\nPossible resource leak on uncompleted re-invite transactions.\nRemote crash vulnerability in voice mail application.\n\n", "edition": 4, "modified": "2012-08-30T00:00:00", "published": "2012-07-05T00:00:00", "id": "4C1AC2DD-C788-11E1-BE25-14DAE9EBCF89", "href": "https://vuxml.freebsd.org/freebsd/4c1ac2dd-c788-11e1-be25-14dae9ebcf89.html", "title": "asterisk -- multiple vulnerabilities", "type": "freebsd", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}], "securityvulns": [{"lastseen": "2018-08-31T11:09:47", "bulletinFamily": "software", "cvelist": ["CVE-2012-3812"], "description": "Few DoS conditions.", "edition": 1, "modified": "2012-07-11T00:00:00", "published": "2012-07-11T00:00:00", "id": "SECURITYVULNS:VULN:12469", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:12469", "title": "Asterisk security vulnerabilities", "type": "securityvulns", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:NONE/I:NONE/A:PARTIAL/"}}], "nessus": [{"lastseen": "2021-01-07T10:43:11", "description": "Asterisk project reports :\n\nPossible resource leak on uncompleted re-invite transactions.\n\nRemote crash vulnerability in voice mail application.", "edition": 21, "published": "2012-07-07T00:00:00", "title": "FreeBSD : asterisk -- multiple vulnerabilities (4c1ac2dd-c788-11e1-be25-14dae9ebcf89)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2012-3812"], "modified": "2012-07-07T00:00:00", "cpe": ["cpe:/o:freebsd:freebsd", "p-cpe:/a:freebsd:freebsd:asterisk", "p-cpe:/a:freebsd:freebsd:asterisk18"], "id": "FREEBSD_PKG_4C1AC2DDC78811E1BE2514DAE9EBCF89.NASL", "href": "https://www.tenable.com/plugins/nessus/59859", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(59859);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2012-3812\");\n\n script_name(english:\"FreeBSD : asterisk -- multiple vulnerabilities (4c1ac2dd-c788-11e1-be25-14dae9ebcf89)\");\n script_summary(english:\"Checks for updated packages in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Asterisk project reports :\n\nPossible resource leak on uncompleted re-invite transactions.\n\nRemote crash vulnerability in voice mail application.\"\n );\n # http://downloads.digium.com/pub/security/AST-2012-010.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://downloads.digium.com/pub/security/AST-2012-010.html\"\n );\n # http://downloads.digium.com/pub/security/AST-2012-011.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://downloads.digium.com/pub/security/AST-2012-011.html\"\n );\n # https://www.asterisk.org/security\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.asterisk.org/downloads/security-advisories\"\n );\n # https://vuxml.freebsd.org/freebsd/4c1ac2dd-c788-11e1-be25-14dae9ebcf89.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?3177fe50\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:asterisk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:asterisk18\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2012/07/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/07/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/07/07\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"asterisk>10.*<10.5.2\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"asterisk18>1.8.*<1.8.13.1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-03-01T01:25:10", "description": "According to the version in its SIP banner, the version of Asterisk\nrunning on the remote host is potentially affected by a vulnerability\nthat could allow a remote, authenticated attacker to crash the server.\n\nIf two remote users interact with a single voicemail account in\nunspecified ways, memory can be corrupted by a double-free vulnerability and this\ncan further lead to application crashes.", "edition": 26, "published": "2012-07-19T00:00:00", "title": "Asterisk Multiple Caller Simultaneous Voicemail Account Manipulation Double-free Remote DoS (AST-2012-011)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2012-3812"], "modified": "2021-03-02T00:00:00", "cpe": ["cpe:/a:digium:asterisk"], "id": "ASTERISK_AST_2012_011.NASL", "href": "https://www.tenable.com/plugins/nessus/60065", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(60065);\n script_version(\"1.10\");\n script_cvs_date(\"Date: 2018/06/27 18:42:26\");\n\n script_cve_id(\"CVE-2012-3812\");\n script_bugtraq_id(54317);\n\n script_name(english:\"Asterisk Multiple Caller Simultaneous Voicemail Account Manipulation Double-free Remote DoS (AST-2012-011)\");\n script_summary(english:\"Checks version in SIP banner\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A telephony application running on the remote host is affected by a\ndenial of service vulnerability.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version in its SIP banner, the version of Asterisk\nrunning on the remote host is potentially affected by a vulnerability\nthat could allow a remote, authenticated attacker to crash the server.\n\nIf two remote users interact with a single voicemail account in\nunspecified ways, memory can be corrupted by a double-free vulnerability and this\ncan further lead to application crashes.\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Asterisk 1.8.13.1 / 10.5.2, Certified Asterisk 1.8.11-cert4\nor apply the patches listed in the Asterisk advisory.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_set_attribute(attribute:\"see_also\", value:\"http://downloads.asterisk.org/pub/security/AST-2012-011.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://issues.asterisk.org/jira/browse/ASTERISK-20052\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2012/06/27\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/06/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/07/19\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:digium:asterisk\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"asterisk_detection.nasl\");\n script_require_keys(\"asterisk/sip_detected\", \"Settings/ParanoidReport\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nget_kb_item_or_exit(\"asterisk/sip_detected\");\n\n# see if we were able to get version info from the Asterisk SIP services\nasterisk_kbs = get_kb_list(\"sip/asterisk/*/version\");\nif (isnull(asterisk_kbs)) exit(1, \"Could not obtain any version information from the Asterisk SIP instance(s).\");\n\n# Prevent potential false positives.\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\n\nis_vuln = FALSE;\nnot_vuln_installs = make_list();\nerrors = make_list();\n\nforeach kb_name (keys(asterisk_kbs))\n{\n vulnerable = 0;\n\n matches = eregmatch(pattern:\"/(udp|tcp)/([0-9]+)/version\", string:kb_name);\n if (isnull(matches))\n {\n errors = make_list(errors, \"Unexpected error parsing port number from kb name: \"+kb_name);\n continue;\n }\n\n proto = matches[1];\n port = matches[2];\n version = asterisk_kbs[kb_name];\n\n if (version == 'unknown')\n {\n errors = make_list(errors, \"Unable to obtain version of install on \" + proto + \"/\" + port);\n continue;\n }\n\n banner = get_kb_item(\"sip/asterisk/\" + proto + \"/\" + port + \"/source\");\n if (!banner)\n {\n # We have version but banner is missing; log error\n # and use in version-check though.\n errors = make_list(errors, \"KB item 'sip/asterisk/\" + proto + \"/\" + port + \"/source' is missing\");\n banner = 'unknown';\n }\n\n # Open Source 10x < 10.5.2\n if (version =~ \"^10([^0-9]|$)\" && \"cert\" >!< tolower(version))\n {\n fixed = \"10.5.2\";\n vulnerable = ver_compare(ver:version, fix:fixed, app:\"asterisk\");\n }\n\n # Open Source 1.8.x < 1.8.13.1\n if (version =~ \"^1\\.8([^0-9]|$)\" && \"cert\" >!< tolower(version))\n {\n fixed = \"1.8.13.1\";\n vulnerable = ver_compare(ver:version, fix:fixed, app:\"asterisk\");\n }\n\n # Asterisk Certified 1.8.11-certx < 1.8.11-cert4\n if (version =~ \"^1\\.8\\.11([^0-9]|$)\" && \"cert\" >< tolower(version))\n {\n fixed = \"1.8.11-cert4\";\n vulnerable = ver_compare(ver:version, fix:fixed, app:\"asterisk\");\n }\n if (vulnerable < 0)\n {\n is_vuln = TRUE;\n if (report_verbosity > 0)\n {\n report =\n '\\n Version source : ' + banner +\n '\\n Installed version : ' + version +\n '\\n Fixed version : ' + fixed + '\\n';\n security_warning(port:port, proto:proto, extra:report);\n }\n else security_warning(port:port, proto:proto);\n }\n else not_vuln_installs = make_list(not_vuln_installs, version + \" on port \" + proto + \"/\" + port);\n}\n\nif (max_index(errors))\n{\n if (max_index(errors) == 1) errmsg = errors[0];\n else errmsg = 'Errors were encountered verifying installs : \\n ' + join(errors, sep:'\\n ');\n\n exit(1, errmsg);\n}\nelse\n{\n installs = max_index(not_vuln_installs);\n if (installs == 0)\n {\n if (is_vuln)\n exit(0);\n else\n audit(AUDIT_NOT_INST, \"Asterisk\");\n }\n else if (installs == 1) audit(AUDIT_INST_VER_NOT_VULN, \"Asterisk \" + not_vuln_installs[0]);\n else exit(0, \"The Asterisk installs (\" + join(not_vuln_installs, sep:\", \") + \") are not affected.\");\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-01-12T10:09:53", "description": "The Asterisk Development Team has announced security releases for\nCertified Asterisk 1.8.11 and Asterisk 1.8 and 10. The available\nsecurity releases are released as versions 1.8.11-cert4, 1.8.13.1,\n10.5.2, and 10.5.2-digiumphones.\n\nThese releases are available for immediate download at\nhttp://downloads.asterisk.org/pub/telephony/asterisk/releases\n\nThe release of Asterisk 1.8.11-cert4, 1.8.13.1, 10.5.2, and\n10.5.2-digiumphones resolve the following two issues :\n\n - If Asterisk sends a re-invite and an endpoint responds\n to the re-invite with a provisional response but never\n sends a final response, then the SIP dialog structure is\n never freed and the RTP ports for the call are never\n released. If an attacker has the ability to place a\n call, they could create a denial of service by using all\n available RTP ports.\n\n - If a single voicemail account is manipulated by two\n parties simultaneously, a condition can occur where\n memory is freed twice causing a crash.\n\nThese issues and their resolution are described in the security\nadvisories.\n\nFor more information about the details of these vulnerabilities,\nplease read security advisories AST-2012-010 and AST-2012-011, which\nwere released at the same time as this announcement.\n\nFor a full list of changes in the current releases, please see the\nChangeLogs :\n\nhttp://downloads.asterisk.org/pub/telephony/certified-asterisk/release\ns/ChangeLog-1.8.11-cert4\nhttp://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo\ng-1.8.13.1\nhttp://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo\ng-10.5.2\nhttp://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo\ng-10.5.2-digiumphones\n\nThe security advisories are available at :\n\n -\n http://downloads.asterisk.org/pub/security/AST-2012-010.\n pdf\n\n -\n http://downloads.asterisk.org/pub/security/AST-2012-01\n 1.pdf\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 14, "published": "2012-07-20T00:00:00", "title": "Fedora 17 : asterisk-10.5.2-1.fc17 (2012-10324)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2012-3863", "CVE-2012-3812"], "modified": "2012-07-20T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:17", "p-cpe:/a:fedoraproject:fedora:asterisk"], "id": "FEDORA_2012-10324.NASL", "href": "https://www.tenable.com/plugins/nessus/60069", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2012-10324.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(60069);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2012-3812\", \"CVE-2012-3863\");\n script_bugtraq_id(54317, 54327);\n script_xref(name:\"FEDORA\", value:\"2012-10324\");\n\n script_name(english:\"Fedora 17 : asterisk-10.5.2-1.fc17 (2012-10324)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The Asterisk Development Team has announced security releases for\nCertified Asterisk 1.8.11 and Asterisk 1.8 and 10. The available\nsecurity releases are released as versions 1.8.11-cert4, 1.8.13.1,\n10.5.2, and 10.5.2-digiumphones.\n\nThese releases are available for immediate download at\nhttp://downloads.asterisk.org/pub/telephony/asterisk/releases\n\nThe release of Asterisk 1.8.11-cert4, 1.8.13.1, 10.5.2, and\n10.5.2-digiumphones resolve the following two issues :\n\n - If Asterisk sends a re-invite and an endpoint responds\n to the re-invite with a provisional response but never\n sends a final response, then the SIP dialog structure is\n never freed and the RTP ports for the call are never\n released. If an attacker has the ability to place a\n call, they could create a denial of service by using all\n available RTP ports.\n\n - If a single voicemail account is manipulated by two\n parties simultaneously, a condition can occur where\n memory is freed twice causing a crash.\n\nThese issues and their resolution are described in the security\nadvisories.\n\nFor more information about the details of these vulnerabilities,\nplease read security advisories AST-2012-010 and AST-2012-011, which\nwere released at the same time as this announcement.\n\nFor a full list of changes in the current releases, please see the\nChangeLogs :\n\nhttp://downloads.asterisk.org/pub/telephony/certified-asterisk/release\ns/ChangeLog-1.8.11-cert4\nhttp://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo\ng-1.8.13.1\nhttp://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo\ng-10.5.2\nhttp://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo\ng-10.5.2-digiumphones\n\nThe security advisories are available at :\n\n -\n http://downloads.asterisk.org/pub/security/AST-2012-010.\n pdf\n\n -\n http://downloads.asterisk.org/pub/security/AST-2012-01\n 1.pdf\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://downloads.asterisk.org/pub/security/AST-2012-010.pdf\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://downloads.asterisk.org/pub/security/AST-2012-011.pdf\"\n );\n # http://downloads.asterisk.org/pub/telephony/asterisk/releases\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://downloads.asterisk.org/pub/telephony/asterisk/releases/\"\n );\n # http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.13.1\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?018f28b9\"\n );\n # http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-10.5.2\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?9a7457b9\"\n );\n # http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-10.5.2-digiumphones\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?4b73d250\"\n );\n # http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-1.8.11-cert4\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?07969e81\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=838178\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=838179\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2012-July/084037.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b0d3841c\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected asterisk package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:asterisk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:17\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/07/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/07/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^17([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 17.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC17\", reference:\"asterisk-10.5.2-1.fc17\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"asterisk\");\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2021-01-07T10:54:28", "description": "The remote host is affected by the vulnerability described in GLSA-201209-15\n(Asterisk: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been found in Asterisk:\n An error in manager.c allows shell access (CVE-2012-2186).\n An error in Asterisk could cause all RTP ports to be exhausted\n (CVE-2012-3812).\n A double-free error could occur when two parties attempt to\n manipulate the same voicemail account simultaneously (CVE-2012-3863).\n Asterisk does not properly implement certain ACL rules\n (CVE-2012-4737).\n \nImpact :\n\n A remote, authenticated attacker could execute arbitrary code with the\n privileges of the process, cause a Denial of Service condition, or bypass\n outbound call restrictions.\n \nWorkaround :\n\n There is no known workaround at this time.", "edition": 21, "published": "2012-09-27T00:00:00", "title": "GLSA-201209-15 : Asterisk: Multiple vulnerabilities", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2012-3863", "CVE-2012-3812", "CVE-2012-2186", "CVE-2012-4737"], "modified": "2012-09-27T00:00:00", "cpe": ["cpe:/o:gentoo:linux", "p-cpe:/a:gentoo:linux:asterisk"], "id": "GENTOO_GLSA-201209-15.NASL", "href": "https://www.tenable.com/plugins/nessus/62344", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201209-15.\n#\n# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(62344);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2012-2186\", \"CVE-2012-3812\", \"CVE-2012-3863\", \"CVE-2012-4737\");\n script_bugtraq_id(54317, 54327, 55335, 55351);\n script_xref(name:\"GLSA\", value:\"201209-15\");\n\n script_name(english:\"GLSA-201209-15 : Asterisk: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201209-15\n(Asterisk: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been found in Asterisk:\n An error in manager.c allows shell access (CVE-2012-2186).\n An error in Asterisk could cause all RTP ports to be exhausted\n (CVE-2012-3812).\n A double-free error could occur when two parties attempt to\n manipulate the same voicemail account simultaneously (CVE-2012-3863).\n Asterisk does not properly implement certain ACL rules\n (CVE-2012-4737).\n \nImpact :\n\n A remote, authenticated attacker could execute arbitrary code with the\n privileges of the process, cause a Denial of Service condition, or bypass\n outbound call restrictions.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201209-15\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All Asterisk users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-misc/asterisk-1.8.15.1'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:asterisk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/09/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/09/27\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"net-misc/asterisk\", unaffected:make_list(\"ge 1.8.15.1\"), vulnerable:make_list(\"lt 1.8.15.1\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Asterisk\");\n}\n", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2021-01-12T09:47:36", "description": "Several vulnerabilities were discovered in Asterisk, a PBX and\ntelephony toolkit, allowing privilege escalation in the Asterisk\nManager, denial of service or privilege escalation.\n\nMore detailed information can be found in the Asterisk advisories:\nAST-2012-010, AST-2012-011, AST-2012-012, and AST-2012-013.", "edition": 16, "published": "2012-09-19T00:00:00", "title": "Debian DSA-2550-2 : asterisk - several vulnerabilities", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2012-3863", "CVE-2012-3812", "CVE-2012-2186", "CVE-2012-4737"], "modified": "2012-09-19T00:00:00", "cpe": ["cpe:/o:debian:debian_linux:6.0", "p-cpe:/a:debian:debian_linux:asterisk"], "id": "DEBIAN_DSA-2550.NASL", "href": "https://www.tenable.com/plugins/nessus/62188", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2550. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(62188);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2012-2186\", \"CVE-2012-3812\", \"CVE-2012-3863\", \"CVE-2012-4737\");\n script_bugtraq_id(54317, 54327, 55335, 55351);\n script_xref(name:\"DSA\", value:\"2550\");\n\n script_name(english:\"Debian DSA-2550-2 : asterisk - several vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities were discovered in Asterisk, a PBX and\ntelephony toolkit, allowing privilege escalation in the Asterisk\nManager, denial of service or privilege escalation.\n\nMore detailed information can be found in the Asterisk advisories:\nAST-2012-010, AST-2012-011, AST-2012-012, and AST-2012-013.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://downloads.asterisk.org/pub/security/AST-2012-010.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://downloads.asterisk.org/pub/security/AST-2012-011.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://downloads.asterisk.org/pub/security/AST-2012-012.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://downloads.asterisk.org/pub/security/AST-2012-013.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze/asterisk\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2012/dsa-2550\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the asterisk packages.\n\nFor the stable distribution (squeeze), these problems have been fixed\nin version 1:1.6.2.9-2+squeeze8.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:asterisk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/09/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/09/19\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"asterisk\", reference:\"1:1.6.2.9-2+squeeze8\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"asterisk-config\", reference:\"1:1.6.2.9-2+squeeze8\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"asterisk-dbg\", reference:\"1:1.6.2.9-2+squeeze8\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"asterisk-dev\", reference:\"1:1.6.2.9-2+squeeze8\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"asterisk-doc\", reference:\"1:1.6.2.9-2+squeeze8\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"asterisk-h323\", reference:\"1:1.6.2.9-2+squeeze8\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"asterisk-sounds-main\", reference:\"1:1.6.2.9-2+squeeze8\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}], "openvas": [{"lastseen": "2017-07-02T21:10:55", "bulletinFamily": "scanner", "cvelist": ["CVE-2012-3812"], "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "modified": "2017-04-25T00:00:00", "published": "2012-08-10T00:00:00", "id": "OPENVAS:71526", "href": "http://plugins.openvas.org/nasl.php?oid=71526", "type": "openvas", "title": "FreeBSD Ports: asterisk", "sourceData": "#\n#VID 4c1ac2dd-c788-11e1-be25-14dae9ebcf89\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from VID 4c1ac2dd-c788-11e1-be25-14dae9ebcf89\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following packages are affected:\n asterisk\n asterisk18\n\nCVE-2012-3812\nDouble free vulnerability in apps/app_voicemail.c in Asterisk Open\nSource 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Certified\nAsterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones\n10.x.x-digiumphones before 10.5.2-digiumphones allows remote\nauthenticated users to cause a denial of service (daemon crash) by\nestablishing multiple voicemail sessions and accessing both the Urgent\nmailbox and the INBOX mailbox.\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://downloads.digium.com/pub/security/AST-2012-011.html\nhttp://downloads.digium.com/pub/security/AST-2012-012.html\nhttps://www.asterisk.org/security\nhttp://www.vuxml.org/freebsd/4c1ac2dd-c788-11e1-be25-14dae9ebcf89.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\n\nif(description)\n{\n script_id(71526);\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_cve_id(\"CVE-2012-3812\");\n script_version(\"$Revision: 6022 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-04-25 14:51:04 +0200 (Tue, 25 Apr 2017) $\");\n script_tag(name:\"creation_date\", value:\"2012-08-10 03:22:17 -0400 (Fri, 10 Aug 2012)\");\n script_name(\"FreeBSD Ports: asterisk\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\nvuln = 0;\ntxt = \"\";\nbver = portver(pkg:\"asterisk\");\nif(!isnull(bver) && revcomp(a:bver, b:\"10\")>0 && revcomp(a:bver, b:\"10.5.2\")<0) {\n txt += \"Package asterisk version \" + bver + \" is installed which is known to be vulnerable.\\n\";\n vuln = 1;\n}\nbver = portver(pkg:\"asterisk18\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.8\")>0 && revcomp(a:bver, b:\"1.8.13.1\")<0) {\n txt += \"Package asterisk18 version \" + bver + \" is installed which is known to be vulnerable.\\n\";\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt ));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:38:32", "bulletinFamily": "scanner", "cvelist": ["CVE-2012-3812"], "description": "The remote host is missing an update to the system\n as announced in the referenced advisory.", "modified": "2018-10-05T00:00:00", "published": "2012-08-10T00:00:00", "id": "OPENVAS:136141256231071526", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231071526", "type": "openvas", "title": "FreeBSD Ports: asterisk", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: freebsd_asterisk1.nasl 11762 2018-10-05 10:54:12Z cfischer $\n#\n# Auto generated from VID 4c1ac2dd-c788-11e1-be25-14dae9ebcf89\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.71526\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_cve_id(\"CVE-2012-3812\");\n script_version(\"$Revision: 11762 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-05 12:54:12 +0200 (Fri, 05 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-08-10 03:22:17 -0400 (Fri, 10 Aug 2012)\");\n script_name(\"FreeBSD Ports: asterisk\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsd\", \"ssh/login/freebsdrel\");\n\n script_tag(name:\"insight\", value:\"The following packages are affected:\n\n asterisk\n asterisk18\n\nCVE-2012-3812\nDouble free vulnerability in apps/app_voicemail.c in Asterisk Open\nSource 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Certified\nAsterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones\n10.x.x-digiumphones before 10.5.2-digiumphones allows remote\nauthenticated users to cause a denial of service (daemon crash) by\nestablishing multiple voicemail sessions and accessing both the Urgent\nmailbox and the INBOX mailbox.\");\n\n script_tag(name:\"solution\", value:\"Update your system with the appropriate patches or\n software upgrades.\");\n\n script_xref(name:\"URL\", value:\"http://downloads.digium.com/pub/security/AST-2012-011.html\");\n script_xref(name:\"URL\", value:\"http://downloads.digium.com/pub/security/AST-2012-012.html\");\n script_xref(name:\"URL\", value:\"https://www.asterisk.org/security\");\n script_xref(name:\"URL\", value:\"http://www.vuxml.org/freebsd/4c1ac2dd-c788-11e1-be25-14dae9ebcf89.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update to the system\n as announced in the referenced advisory.\");\n\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-bsd.inc\");\n\nvuln = FALSE;\ntxt = \"\";\n\nbver = portver(pkg:\"asterisk\");\nif(!isnull(bver) && revcomp(a:bver, b:\"10\")>0 && revcomp(a:bver, b:\"10.5.2\")<0) {\n txt += \"Package asterisk version \" + bver + \" is installed which is known to be vulnerable.\\n\";\n vuln = TRUE;\n}\nbver = portver(pkg:\"asterisk18\");\nif(!isnull(bver) && revcomp(a:bver, b:\"1.8\")>0 && revcomp(a:bver, b:\"1.8.13.1\")<0) {\n txt += \"Package asterisk18 version \" + bver + \" is installed which is known to be vulnerable.\\n\";\n vuln = TRUE;\n}\n\nif(vuln) {\n security_message(data:txt);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2018-01-02T10:58:26", "bulletinFamily": "scanner", "cvelist": ["CVE-2012-3863", "CVE-2012-3812"], "description": "Check for the Version of asterisk", "modified": "2017-12-26T00:00:00", "published": "2012-08-30T00:00:00", "id": "OPENVAS:864554", "href": "http://plugins.openvas.org/nasl.php?oid=864554", "type": "openvas", "title": "Fedora Update for asterisk FEDORA-2012-10324", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for asterisk FEDORA-2012-10324\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"asterisk on Fedora 17\";\ntag_insight = \"Asterisk is a complete PBX in software. It runs on Linux and provides\n all of the features you would expect from a PBX and more. Asterisk\n does voice over IP in three protocols, and can interoperate with\n almost all standards-based telephony equipment using relatively\n inexpensive hardware.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2012-July/084037.html\");\n script_id(864554);\n script_version(\"$Revision: 8245 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-26 07:29:59 +0100 (Tue, 26 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2012-08-30 10:46:10 +0530 (Thu, 30 Aug 2012)\");\n script_cve_id(\"CVE-2012-3863\", \"CVE-2012-3812\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_xref(name: \"FEDORA\", value: \"2012-10324\");\n script_name(\"Fedora Update for asterisk FEDORA-2012-10324\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of asterisk\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC17\")\n{\n\n if ((res = isrpmvuln(pkg:\"asterisk\", rpm:\"asterisk~10.5.2~1.fc17\", rls:\"FC17\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:39:24", "bulletinFamily": "scanner", "cvelist": ["CVE-2012-3863", "CVE-2012-3812"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2012-08-30T00:00:00", "id": "OPENVAS:1361412562310864554", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310864554", "type": "openvas", "title": "Fedora Update for asterisk FEDORA-2012-10324", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for asterisk FEDORA-2012-10324\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.fedoraproject.org/pipermail/package-announce/2012-July/084037.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.864554\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2012-08-30 10:46:10 +0530 (Thu, 30 Aug 2012)\");\n script_cve_id(\"CVE-2012-3863\", \"CVE-2012-3812\");\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:N/I:N/A:P\");\n script_xref(name:\"FEDORA\", value:\"2012-10324\");\n script_name(\"Fedora Update for asterisk FEDORA-2012-10324\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'asterisk'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC17\");\n script_tag(name:\"affected\", value:\"asterisk on Fedora 17\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC17\")\n{\n\n if ((res = isrpmvuln(pkg:\"asterisk\", rpm:\"asterisk~10.5.2~1.fc17\", rls:\"FC17\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}, {"lastseen": "2017-07-24T12:51:07", "bulletinFamily": "scanner", "cvelist": ["CVE-2012-3863", "CVE-2012-3812", "CVE-2012-2186", "CVE-2012-4737"], "description": "The remote host is missing updates announced in\nadvisory GLSA 201209-15.", "modified": "2017-07-07T00:00:00", "published": "2012-10-03T00:00:00", "id": "OPENVAS:72449", "href": "http://plugins.openvas.org/nasl.php?oid=72449", "type": "openvas", "title": "Gentoo Security Advisory GLSA 201209-15 (asterisk)", "sourceData": "#\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple vulnerabilities have been found in Asterisk, the worst of\n which may allow execution of arbitrary code.\";\ntag_solution = \"All Asterisk users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-misc/asterisk-1.8.15.1'\n \n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20201209-15\nhttp://bugs.gentoo.org/show_bug.cgi?id=425050\nhttp://bugs.gentoo.org/show_bug.cgi?id=433750\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 201209-15.\";\n\n \n \nif(description)\n{\n script_id(72449);\n script_tag(name:\"cvss_base\", value:\"9.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2012-2186\", \"CVE-2012-3812\", \"CVE-2012-3863\", \"CVE-2012-4737\");\n script_version(\"$Revision: 6593 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:18:14 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2012-10-03 11:11:28 -0400 (Wed, 03 Oct 2012)\");\n script_name(\"Gentoo Security Advisory GLSA 201209-15 (asterisk)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\nres = \"\";\nreport = \"\";\nif((res = ispkgvuln(pkg:\"net-misc/asterisk\", unaffected: make_list(\"ge 1.8.15.1\"), vulnerable: make_list(\"lt 1.8.15.1\"))) != NULL ) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:38:33", "bulletinFamily": "scanner", "cvelist": ["CVE-2012-3863", "CVE-2012-3812", "CVE-2012-2186", "CVE-2012-4737"], "description": "The remote host is missing an update to asterisk\nannounced via advisory DSA 2550-1.", "modified": "2019-03-18T00:00:00", "published": "2012-09-23T00:00:00", "id": "OPENVAS:136141256231072408", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231072408", "type": "openvas", "title": "Debian Security Advisory DSA 2550-1 (asterisk)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2550_1.nasl 14275 2019-03-18 14:39:45Z cfischer $\n# Description: Auto-generated from advisory DSA 2550-1 (asterisk)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.72408\");\n script_tag(name:\"cvss_base\", value:\"9.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2012-2186\", \"CVE-2012-3812\", \"CVE-2012-3863\", \"CVE-2012-4737\");\n script_version(\"$Revision: 14275 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:39:45 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2012-09-23 02:15:34 -0400 (Sun, 23 Sep 2012)\");\n script_name(\"Debian Security Advisory DSA 2550-1 (asterisk)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB(6|7)\");\n script_xref(name:\"URL\", value:\"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202550-1\");\n script_tag(name:\"insight\", value:\"Several vulnerabilities were discovered in Asterisk, a PBX and telephony\ntoolkit, allowing privilege escalation in the Asterisk Manager, denial of\nservice or privilege escalation.\n\nFor the stable distribution (squeeze), these problems have been fixed in\nversion 1:1.6.2.9-2+squeeze7.\n\nFor the testing distribution (wheezy) and the unstable distribution (sid),\nthese problems have been fixed in version 1:1.8.13.1~dfsg-1.\");\n\n script_tag(name:\"solution\", value:\"We recommend that you upgrade your asterisk packages.\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update to asterisk\nannounced via advisory DSA 2550-1.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"asterisk\", ver:\"1:1.6.2.9-2+squeeze7\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-config\", ver:\"1:1.6.2.9-2+squeeze7\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-dbg\", ver:\"1:1.6.2.9-2+squeeze7\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-dev\", ver:\"1:1.6.2.9-2+squeeze7\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-doc\", ver:\"1:1.6.2.9-2+squeeze7\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-h323\", ver:\"1:1.6.2.9-2+squeeze7\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-sounds-main\", ver:\"1:1.6.2.9-2+squeeze7\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-config\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-dahdi\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-dbg\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-dev\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-doc\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-mobile\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-modules\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-mp3\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-mysql\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-ooh323\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-voicemail\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-voicemail-imapstorage\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-voicemail-odbcstorage\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:39:04", "bulletinFamily": "scanner", "cvelist": ["CVE-2012-3863", "CVE-2012-3812", "CVE-2012-2186", "CVE-2012-4737"], "description": "The remote host is missing an update to asterisk\nannounced via advisory DSA 2550-2.", "modified": "2019-03-18T00:00:00", "published": "2012-10-03T00:00:00", "id": "OPENVAS:136141256231072441", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231072441", "type": "openvas", "title": "Debian Security Advisory DSA 2550-2 (asterisk)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2550_2.nasl 14275 2019-03-18 14:39:45Z cfischer $\n# Description: Auto-generated from advisory DSA 2550-2 (asterisk)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.72441\");\n script_tag(name:\"cvss_base\", value:\"9.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2012-2186\", \"CVE-2012-3812\", \"CVE-2012-3863\", \"CVE-2012-4737\");\n script_version(\"$Revision: 14275 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:39:45 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2012-10-03 11:09:39 -0400 (Wed, 03 Oct 2012)\");\n script_name(\"Debian Security Advisory DSA 2550-2 (asterisk)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB6\");\n script_xref(name:\"URL\", value:\"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202550-2\");\n script_tag(name:\"insight\", value:\"A regression in the SIP handling code was found in DSA-2550-1.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 1:1.6.2.9-2+squeeze8.\");\n\n script_tag(name:\"solution\", value:\"We recommend that you upgrade your asterisk packages.\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update to asterisk\nannounced via advisory DSA 2550-2.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"asterisk\", ver:\"1:1.6.2.9-2+squeeze8\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-config\", ver:\"1:1.6.2.9-2+squeeze8\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-dbg\", ver:\"1:1.6.2.9-2+squeeze8\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-dev\", ver:\"1:1.6.2.9-2+squeeze8\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-doc\", ver:\"1:1.6.2.9-2+squeeze8\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-h323\", ver:\"1:1.6.2.9-2+squeeze8\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-sounds-main\", ver:\"1:1.6.2.9-2+squeeze8\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2017-07-24T12:51:00", "bulletinFamily": "scanner", "cvelist": ["CVE-2012-3863", "CVE-2012-3812", "CVE-2012-2186", "CVE-2012-4737"], "description": "The remote host is missing an update to asterisk\nannounced via advisory DSA 2550-2.", "modified": "2017-07-07T00:00:00", "published": "2012-10-03T00:00:00", "id": "OPENVAS:72441", "href": "http://plugins.openvas.org/nasl.php?oid=72441", "type": "openvas", "title": "Debian Security Advisory DSA 2550-2 (asterisk)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2550_2.nasl 6612 2017-07-07 12:08:03Z cfischer $\n# Description: Auto-generated from advisory DSA 2550-2 (asterisk)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A regression in the SIP handling code was found in DSA-2550-1.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 1:1.6.2.9-2+squeeze8.\n\nWe recommend that you upgrade your asterisk packages.\";\ntag_summary = \"The remote host is missing an update to asterisk\nannounced via advisory DSA 2550-2.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202550-2\";\n\nif(description)\n{\n script_id(72441);\n script_tag(name:\"cvss_base\", value:\"9.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2012-2186\", \"CVE-2012-3812\", \"CVE-2012-3863\", \"CVE-2012-4737\");\n script_version(\"$Revision: 6612 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:08:03 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2012-10-03 11:09:39 -0400 (Wed, 03 Oct 2012)\");\n script_name(\"Debian Security Advisory DSA 2550-2 (asterisk)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"asterisk\", ver:\"1:1.6.2.9-2+squeeze8\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-config\", ver:\"1:1.6.2.9-2+squeeze8\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-dbg\", ver:\"1:1.6.2.9-2+squeeze8\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-dev\", ver:\"1:1.6.2.9-2+squeeze8\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-doc\", ver:\"1:1.6.2.9-2+squeeze8\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-h323\", ver:\"1:1.6.2.9-2+squeeze8\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-sounds-main\", ver:\"1:1.6.2.9-2+squeeze8\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:50:49", "bulletinFamily": "scanner", "cvelist": ["CVE-2012-3863", "CVE-2012-3812", "CVE-2012-2186", "CVE-2012-4737"], "description": "The remote host is missing an update to asterisk\nannounced via advisory DSA 2550-1.", "modified": "2017-07-07T00:00:00", "published": "2012-09-23T00:00:00", "id": "OPENVAS:72408", "href": "http://plugins.openvas.org/nasl.php?oid=72408", "type": "openvas", "title": "Debian Security Advisory DSA 2550-1 (asterisk)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2550_1.nasl 6612 2017-07-07 12:08:03Z cfischer $\n# Description: Auto-generated from advisory DSA 2550-1 (asterisk)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Several vulnerabilities were discovered in Asterisk, a PBX and telephony\ntoolkit, allowing privilege escalation in the Asterisk Manager, denial of\nservice or privilege escalation.\n\nMore detailed information can be found in the Asterisk advisories:\nhttp://downloads.asterisk.org/pub/security/AST-2012-010.html\nhttp://downloads.asterisk.org/pub/security/AST-2012-011.html\nhttp://downloads.asterisk.org/pub/security/AST-2012-012.html\nhttp://downloads.asterisk.org/pub/security/AST-2012-013.html\n\nFor the stable distribution (squeeze), these problems have been fixed in\nversion 1:1.6.2.9-2+squeeze7.\n\nFor the testing distribution (wheezy) and the unstable distribution (sid),\nthese problems have been fixed in version 1:1.8.13.1~dfsg-1.\n\nWe recommend that you upgrade your asterisk packages.\";\ntag_summary = \"The remote host is missing an update to asterisk\nannounced via advisory DSA 2550-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202550-1\";\n\nif(description)\n{\n script_id(72408);\n script_tag(name:\"cvss_base\", value:\"9.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2012-2186\", \"CVE-2012-3812\", \"CVE-2012-3863\", \"CVE-2012-4737\");\n script_version(\"$Revision: 6612 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:08:03 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2012-09-23 02:15:34 -0400 (Sun, 23 Sep 2012)\");\n script_name(\"Debian Security Advisory DSA 2550-1 (asterisk)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"asterisk\", ver:\"1:1.6.2.9-2+squeeze7\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-config\", ver:\"1:1.6.2.9-2+squeeze7\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-dbg\", ver:\"1:1.6.2.9-2+squeeze7\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-dev\", ver:\"1:1.6.2.9-2+squeeze7\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-doc\", ver:\"1:1.6.2.9-2+squeeze7\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-h323\", ver:\"1:1.6.2.9-2+squeeze7\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-sounds-main\", ver:\"1:1.6.2.9-2+squeeze7\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-config\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-dahdi\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-dbg\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-dev\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-doc\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-mobile\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-modules\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-mp3\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-mysql\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-ooh323\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-voicemail\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-voicemail-imapstorage\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"asterisk-voicemail-odbcstorage\", ver:\"1:1.8.13.1~dfsg-1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:38:50", "bulletinFamily": "scanner", "cvelist": ["CVE-2012-3863", "CVE-2012-3812", "CVE-2012-2186", "CVE-2012-4737"], "description": "The remote host is missing updates announced in\nadvisory GLSA 201209-15.", "modified": "2018-10-12T00:00:00", "published": "2012-10-03T00:00:00", "id": "OPENVAS:136141256231072449", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231072449", "type": "openvas", "title": "Gentoo Security Advisory GLSA 201209-15 (asterisk)", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: glsa_201209_15.nasl 11859 2018-10-12 08:53:01Z cfischer $\n#\n# Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.72449\");\n script_tag(name:\"cvss_base\", value:\"9.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2012-2186\", \"CVE-2012-3812\", \"CVE-2012-3863\", \"CVE-2012-4737\");\n script_version(\"$Revision: 11859 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-12 10:53:01 +0200 (Fri, 12 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-10-03 11:11:28 -0400 (Wed, 03 Oct 2012)\");\n script_name(\"Gentoo Security Advisory GLSA 201209-15 (asterisk)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name:\"insight\", value:\"Multiple vulnerabilities have been found in Asterisk, the worst of\n which may allow execution of arbitrary code.\");\n script_tag(name:\"solution\", value:\"All Asterisk users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-misc/asterisk-1.8.15.1'\");\n\n script_xref(name:\"URL\", value:\"http://www.securityspace.com/smysecure/catid.html?in=GLSA%20201209-15\");\n script_xref(name:\"URL\", value:\"http://bugs.gentoo.org/show_bug.cgi?id=425050\");\n script_xref(name:\"URL\", value:\"http://bugs.gentoo.org/show_bug.cgi?id=433750\");\n script_tag(name:\"summary\", value:\"The remote host is missing updates announced in\nadvisory GLSA 201209-15.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"pkg-lib-gentoo.inc\");\ninclude(\"revisions-lib.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = ispkgvuln(pkg:\"net-misc/asterisk\", unaffected: make_list(\"ge 1.8.15.1\"), vulnerable: make_list(\"lt 1.8.15.1\"))) != NULL ) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}], "fedora": [{"lastseen": "2020-12-21T08:17:51", "bulletinFamily": "unix", "cvelist": ["CVE-2012-3812", "CVE-2012-3863"], "description": "Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware. ", "modified": "2012-07-20T01:57:54", "published": "2012-07-20T01:57:54", "id": "FEDORA:390DD20AC9", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 17 Update: asterisk-10.5.2-1.fc17", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}}], "debian": [{"lastseen": "2020-11-11T13:12:31", "bulletinFamily": "unix", "cvelist": ["CVE-2012-3863", "CVE-2012-3812", "CVE-2012-2186", "CVE-2012-4737"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2550-1 security@debian.org\nhttp://www.debian.org/security/ Moritz Muehlenhoff\nSeptember 18, 2012 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : asterisk\nVulnerability : several\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2012-2186 CVE-2012-3812 CVE-2012-3863 CVE-2012-4737\n\nSeveral vulnerabilities were discovered in Asterisk, a PBX and telephony \ntoolkit, allowing privilege escalation in the Asterisk Manager, denial of\nservice or privilege escalation.\n\nMore detailed information can be found in the Asterisk advisories:\nhttp://downloads.asterisk.org/pub/security/AST-2012-010.html\nhttp://downloads.asterisk.org/pub/security/AST-2012-011.html\nhttp://downloads.asterisk.org/pub/security/AST-2012-012.html\nhttp://downloads.asterisk.org/pub/security/AST-2012-013.html \n\nFor the stable distribution (squeeze), these problems have been fixed in\nversion 1:1.6.2.9-2+squeeze7.\n\nFor the testing distribution (wheezy) and the unstable distribution (sid), \nthese problems have been fixed in version 1:1.8.13.1~dfsg-1.\n\nWe recommend that you upgrade your asterisk packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 7, "modified": "2012-09-18T17:19:18", "published": "2012-09-18T17:19:18", "id": "DEBIAN:DSA-2550-1:D149A", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2012/msg00193.html", "title": "[SECURITY] [DSA 2550-1] asterisk security update", "type": "debian", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2020-11-11T13:18:17", "bulletinFamily": "unix", "cvelist": ["CVE-2012-3863", "CVE-2012-3812", "CVE-2012-2186", "CVE-2012-4737"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2550-2 security@debian.org\nhttp://www.debian.org/security/ Moritz Muehlenhoff\nSeptember 26, 2012 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : asterisk\nVulnerability : several\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2012-2186 CVE-2012-3812 CVE-2012-3863 CVE-2012-4737\n\nA regression in the SIP handling code was found in DSA-2550-1. \n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 1:1.6.2.9-2+squeeze8.\n\nWe recommend that you upgrade your asterisk packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 3, "modified": "2012-09-26T16:05:34", "published": "2012-09-26T16:05:34", "id": "DEBIAN:DSA-2550-2:6ADB9", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2012/msg00196.html", "title": "[SECURITY] [DSA 2550-2] asterisk regression update", "type": "debian", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:17", "bulletinFamily": "unix", "cvelist": ["CVE-2012-3863", "CVE-2012-3812", "CVE-2012-2186", "CVE-2012-4737"], "description": "### Background\n\nAsterisk is an open source telephony engine and toolkit.\n\n### Description\n\nMultiple vulnerabilities have been found in Asterisk:\n\n * An error in manager.c allows shell access (CVE-2012-2186).\n * An error in Asterisk could cause all RTP ports to be exhausted (CVE-2012-3812). \n * A double-free error could occur when two parties attempt to manipulate the same voicemail account simultaneously (CVE-2012-3863). \n * Asterisk does not properly implement certain ACL rules (CVE-2012-4737). \n\n### Impact\n\nA remote, authenticated attacker could execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or bypass outbound call restrictions. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Asterisk users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-misc/asterisk-1.8.15.1\"", "edition": 1, "modified": "2012-09-26T00:00:00", "published": "2012-09-26T00:00:00", "id": "GLSA-201209-15", "href": "https://security.gentoo.org/glsa/201209-15", "type": "gentoo", "title": "Asterisk: Multiple vulnerabilities", "cvss": {"score": 9.0, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}