ID

VAR-201208-0619

CVE

CVE-2012-2186

TITLE

plural Asterisk Product of main/manager.c Vulnerable to arbitrary command execution

DESCRIPTION

Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 allows remote authenticated users to execute arbitrary commands by leveraging originate privileges and providing an ExternalIVR value in an AMI Originate action. Asterisk is prone to a security-bypass vulnerability that affects the manager interface. An attacker can exploit this issue to bypass certain security restrictions and execute shell commands within the context of the affected application. Asterisk Project Security Advisory - AST-2012-012 Product Asterisk Summary Asterisk Manager User Unauthorized Shell Access Nature of Advisory Permission Escalation Susceptibility Remote Authenticated Sessions Severity Minor Exploits Known No Reported On July 13, 2012 Reported By Zubair Ashraf of IBM X-Force Research Posted On August 30, 2012 Last Updated On August 30, 2012 Advisory Contact Matt Jordan < mjordan AT digium DOT com > CVE Name CVE-2012-2186 Description The AMI Originate action can allow a remote user to specify information that can be used to execute shell commands on the system hosting Asterisk. This can result in an unwanted escalation of permissions, as the Originate action, which requires the "originate" class authorization, can be used to perform actions that would typically require the "system" class authorization. Previous attempts to prevent this permission escalation (AST-2011-006, AST-2012-004) have sought to do so by inspecting the names of applications and functions passed in with the Originate action and, if those applications/functions matched a predefined set of values, rejecting the command if the user lacked the "system" class authorization. As reported by IBM X-Force Research, the "ExternalIVR" application is not listed in the predefined set of values. The solution for this particular vulnerability is to include the "ExternalIVR" application in the set of defined applications/functions that require "system" class authorization. Unfortunately, the approach of inspecting fields in the Originate action against known applications/functions has a significant flaw. The predefined set of values can be bypassed by creative use of the Originate action or by certain dialplan configurations, which is beyond the ability of Asterisk to analyze at run-time. Attempting to work around these scenarios would result in severely restricting the applications or functions and prevent their usage for legitimate means. As such, any additional security vulnerabilities, where an application/function that would normally require the "system" class authorization can be executed by users with the "originate" class authorization, will not be addressed. Proper system configuration can limit the impact of such scenarios. The next release of each version of Asterisk will contain, in addition to the fix for the "ExternalIVR" application, an updated README-SERIOUSLY.bestpractices.txt file. Resolution Asterisk now checks for the "ExternalIVR" application when processing the Originate action. Additionally, the README-SERIOUSLY.bestpractices.txt file has been updated. It is highly recommended that, if AMI is utilized with accounts that have the "originate" class authorization, Asterisk is run under a defined user that does not have root permissions. Accounts with the "originate" class authorization should be treated in a similar manner to those with the "system" class authorization. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201209-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Asterisk: Multiple vulnerabilities Date: September 26, 2012 Bugs: #425050, #433750 ID: 201209-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Asterisk, the worst of which may allow execution of arbitrary code. Background ========== Asterisk is an open source telephony engine and toolkit. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/asterisk < 1.8.15.1 >= 1.8.15.1 Description =========== Multiple vulnerabilities have been found in Asterisk: * An error in manager.c allows shell access (CVE-2012-2186). * An error in Asterisk could cause all RTP ports to be exhausted (CVE-2012-3812). * A double-free error could occur when two parties attempt to manipulate the same voicemail account simultaneously (CVE-2012-3863). * Asterisk does not properly implement certain ACL rules (CVE-2012-4737). Impact ====== A remote, authenticated attacker could execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or bypass outbound call restrictions. Workaround ========== There is no known workaround at this time. Resolution ========== All Asterisk users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.8.15.1" References ========== [ 1 ] CVE-2012-2186 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2186 [ 2 ] CVE-2012-3812 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3812 [ 3 ] CVE-2012-3863 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3863 [ 4 ] CVE-2012-4737 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4737 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201209-15.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2550-1 security@debian.org http://www.debian.org/security/ Moritz Muehlenhoff September 18, 2012 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : asterisk Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2012-2186 CVE-2012-3812 CVE-2012-3863 CVE-2012-4737 Several vulnerabilities were discovered in Asterisk, a PBX and telephony toolkit, allowing privilege escalation in the Asterisk Manager, denial of service or privilege escalation. More detailed information can be found in the Asterisk advisories: http://downloads.asterisk.org/pub/security/AST-2012-010.html http://downloads.asterisk.org/pub/security/AST-2012-011.html http://downloads.asterisk.org/pub/security/AST-2012-012.html http://downloads.asterisk.org/pub/security/AST-2012-013.html For the stable distribution (squeeze), these problems have been fixed in version 1:1.6.2.9-2+squeeze7. For the testing distribution (wheezy) and the unstable distribution (sid), these problems have been fixed in version 1:1.8.13.1~dfsg-1. We recommend that you upgrade your asterisk packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlBYrLoACgkQXm3vHE4uylqDBgCfTQnp2Z1XZSgJkg1L84SDPnjK muwAoOINdMCYMfcEc8spGQ7wrCWPKGaR =FRM+ -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/ ---------------------------------------------------------------------- TITLE: Debian update for asterisk SECUNIA ADVISORY ID: SA50687 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/50687/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=50687 RELEASE DATE: 2012-09-19 DISCUSS ADVISORY: http://secunia.com/advisories/50687/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/50687/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=50687 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Debian has issued an update for asterisk. For more information: SA49814 SA50456 SOLUTION: Apply updated packages via the apt-get package manager. ORIGINAL ADVISORY: DSA-2550-1: http://www.debian.org/security/2012/dsa-2550 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

Access Validation Error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Zubair Ashraf of IBM X-Force Research

SOURCES

LAST UPDATE DATE

2024-11-23T21:55:51.423000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE