Vulnerabilities > CVE-2010-0685 - Remote Security vulnerability in Asterisk

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

PARTIAL

Availability impact

NONE

network

low complexity

digium

nessus

NVD

Published: 2010-02-23

Updated: 2018-10-10

Summary

The design of the dialplan functionality in Asterisk Open Source 1.2.x, 1.4.x, and 1.6.x; and Asterisk Business Edition B.x.x and C.x.x, when using the ${EXTEN} channel variable and wildcard pattern matches, allows context-dependent attackers to inject strings into the dialplan using metacharacters that are injected when the variable is expanded, as demonstrated using the Dial application to process a crafted SIP INVITE message that adds an unintended outgoing channel leg. NOTE: it could be argued that this is not a vulnerability in Asterisk, but a class of vulnerabilities that can occur in any program that uses this feature without the associated filtering functionality that is already available.

Vulnerable Configurations

Part	Description	Count
Application	Digium Digium Asterisk 1.2.0 Digium Asterisk 1.2.1 Digium Asterisk 1.2.2 Digium Asterisk 1.2.3 Digium Asterisk 1.2.6 Digium Asterisk 1.2.7 Digium Asterisk 1.2.8 Digium Asterisk 1.2.9 Digium Asterisk 1.2.10 Digium Asterisk 1.2.11 Digium Asterisk 1.2.12 Digium Asterisk 1.2.12.1 Digium Asterisk 1.2.13 Digium Asterisk 1.2.14 Digium Asterisk 1.2.15 Digium Asterisk 1.2.16 Digium Asterisk 1.2.17 Digium Asterisk 1.2.18 Digium Asterisk 1.2.19 Digium Asterisk 1.2.20 Digium Asterisk 1.2.21 Digium Asterisk 1.2.21.1 Digium Asterisk 1.2.22 Digium Asterisk 1.2.23 Digium Asterisk 1.2.24 Digium Asterisk 1.2.25 Digium Asterisk 1.2.26 Digium Asterisk 1.2.26.1 Digium Asterisk 1.2.26.2 Digium Asterisk 1.2.27 Digium Asterisk 1.2.28 Digium Asterisk 1.2.28.1 Digium Asterisk 1.2.29 Digium Asterisk 1.2.30 Digium Asterisk 1.2.30.1 Digium Asterisk 1.2.30.2 Digium Asterisk 1.2.30.3 Digium Asterisk 1.2.30.4 Digium Asterisk 1.2.31 Digium Asterisk 1.2.31.1 Digium Asterisk 1.2.32 Digium Asterisk 1.2.33 Digium Asterisk 1.2.34 Digium Asterisk 1.2.35 Digium Asterisk 1.2.36 Digium Asterisk 1.4.0 Digium Asterisk 1.4.1 Digium Asterisk 1.4.2 Digium Asterisk 1.4.3 Digium Asterisk 1.4.4 Digium Asterisk 1.4.5 Digium Asterisk 1.4.6 Digium Asterisk 1.4.7 Digium Asterisk 1.4.8 Digium Asterisk 1.4.9 Digium Asterisk 1.4.10 Digium Asterisk 1.4.11 Digium Asterisk 1.4.12 Digium Asterisk 1.4.13 Digium Asterisk 1.4.14 Digium Asterisk 1.4.15 Digium Asterisk 1.4.16 Digium Asterisk 1.4.17 Digium Asterisk 1.4.18 Digium Asterisk 1.4.19 Digium Asterisk 1.4.20 Digium Asterisk 1.4.21 Digium Asterisk 1.4.22 Digium Asterisk 1.4.23 Digium Asterisk 1.4.24 Digium Asterisk 1.4.25 Digium Asterisk 1.4.26 Digium Asterisk 1.4.27 Digium Asterisk 1.6.0 Digium Asterisk 1.6.1 Digium Asterisk 1.6.1.0 Digium Asterisk 1.6.2.0 Digium Asterisk B.1.3.2 Digium Asterisk B.1.3.3 Digium Asterisk B.2.2.0 Digium Asterisk B.2.2.1 Digium Asterisk B.2.3.1 Digium Asterisk B.2.3.2 Digium Asterisk B.2.3.3 Digium Asterisk B.2.3.4 Digium Asterisk B.2.3.5 Digium Asterisk B.2.3.6 Digium Asterisk B.2.5.0 Digium Asterisk B.2.5.1 Digium Asterisk B.2.5.2 Digium Asterisk B.2.5.3 Digium Asterisk C.1.0 Digium Asterisk C.1.6 Digium Asterisk C.1.6.1 Digium Asterisk C.1.6.2 Digium Asterisk C.1.8.0 Digium Asterisk C.1.8.1 Digium Asterisk C.2.3 Digium Asterisk C.3.0	126

Nessus

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2010-3724.NASL
description	Update to 1.6.1.17 * AST-2010-003: Invalid parsing of ACL rules can compromise security * AST-2010-002: This security release is intended to raise awareness of how it is possible to insert malicious strings into dialplans, and to advise developers to read the best practices documents so that they may easily avoid these dangers. * AST-2010-001: An attacker attempting to negotiate T.38 over SIP can remotely crash Asterisk by modifying the FaxMaxDatagram field of the SDP to contain either a negative or exceptionally large value. The same crash occurs when the FaxMaxDatagram field is omitted from the SDP as well. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	47325
published	2010-07-01
reporter	This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/47325
title	Fedora 11 : asterisk-1.6.1.17-1.fc11 (2010-3724)

Summary

Vulnerable Configurations

Nessus

References