Executive Summary
| Summary | |
|---|---|
| Title | New Asterisk packages fix arbitrary code execution |
| Informations | |||
|---|---|---|---|
| Name | DSA-1048 | First vendor Publication | 2006-05-01 |
| Vendor | Debian | Last vendor Modification | 2006-05-01 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.4 | Attack Range | Network |
| Cvss Impact Score | 4.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Several problems have been discovered in Asterisk, an Open Source Private Branch Exchange (telephone control center). The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2005-3559 Adam Pointon discovered that due to missing input sanitising it is possible to retrieve recorded phone messages for a different extension. CVE-2006-1827 Emmanouel Kellinis discovered an integer signedness error that could trigger a buffer overflow and hence allow the execution of arbitrary code. For the old stable distribution (woody) this problem has been fixed in version 0.1.11-3woody1. For the stable distribution (sarge) this problem has been fixed in version 1.0.7.dfsg.1-2sarge2. For the unstable distribution (sid) this problem has been fixed in version 1.2.7.1.dfsg-1. We recommend that you upgrade your asterisk package. |
Original Source
| Url : http://www.debian.org/security/2006/dsa-1048 |
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-09-04 | Name : FreeBSD Ports: asterisk File : nvt/freebsd_asterisk.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1048-1 (asterisk) File : nvt/deb_1048_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 24893 | Asterisk JPEG Image Processing Overflow |
| 20577 | Asterisk vmail.cgi folder Variable Traversal Arbitrary .wav File Access Asterisk contains a flaw that allows an authenticated user to access other users' voice mail wav files. The issue is due to the vmail.cgi not properly sanitizing user input, specifically traversal style attacks (../../) supplied via the "folder" variable. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1048.nasl - Type : ACT_GATHER_INFO |
| 2006-05-13 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_8b683bead49c11daa672000e0c2e438a.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:25:44 |
|
