Lucene search
HistorySep 02, 2017 - 4:29 p.m.
CVE-2017-14100
asterisk
cve-2017-14100
security vulnerability
command execution
unauthorized access
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.5 High
AI Score
Confidence
High
0.961 High
EPSS
Percentile
99.5%
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command execution is possible. The app_minivm module has an “externnotify” program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source, a crafted caller-id name or number allows an arbitrary shell command injection.
Affected configurations
Node
digiumasteriskMatch13.0.0lts
ORdigiumasteriskMatch13.0.0beta1
ORdigiumasteriskMatch13.0.0beta2
ORdigiumasteriskMatch13.0.0beta3
ORdigiumasteriskMatch13.0.1
ORdigiumasteriskMatch13.0.2
ORdigiumasteriskMatch13.1.0
ORdigiumasteriskMatch13.1.0rc1
ORdigiumasteriskMatch13.1.0rc2
ORdigiumasteriskMatch13.1.1
ORdigiumasteriskMatch13.2.0
ORdigiumasteriskMatch13.2.0rc1
ORdigiumasteriskMatch13.2.1
ORdigiumasteriskMatch13.3.0rc1
ORdigiumasteriskMatch13.3.2
ORdigiumasteriskMatch13.4.0
ORdigiumasteriskMatch13.4.0rc1
ORdigiumasteriskMatch13.5.0
ORdigiumasteriskMatch13.5.0rc1
ORdigiumasteriskMatch13.6.0rc1
ORdigiumasteriskMatch13.7.0rc1
ORdigiumasteriskMatch13.7.0rc2
ORdigiumasteriskMatch13.7.1
ORdigiumasteriskMatch13.7.2
ORdigiumasteriskMatch13.8.0
ORdigiumasteriskMatch13.8.0rc1
ORdigiumasteriskMatch13.8.1
ORdigiumasteriskMatch13.8.2
ORdigiumasteriskMatch13.9.0
ORdigiumasteriskMatch13.9.1
ORdigiumasteriskMatch13.10.0
ORdigiumasteriskMatch13.10.0rc1
ORdigiumasteriskMatch13.11.0
ORdigiumasteriskMatch13.11.1
ORdigiumasteriskMatch13.11.2
ORdigiumasteriskMatch13.12
ORdigiumasteriskMatch13.12.0
ORdigiumasteriskMatch13.12.1
ORdigiumasteriskMatch13.12.2
ORdigiumasteriskMatch13.13
ORdigiumasteriskMatch13.13.0
ORdigiumasteriskMatch13.13.1
ORdigiumasteriskMatch13.14.0
ORdigiumasteriskMatch13.14.0rc1
ORdigiumasteriskMatch13.14.0rc2
ORdigiumasteriskMatch13.14.1
ORdigiumasteriskMatch13.15.0
ORdigiumasteriskMatch13.15.0rc1
ORdigiumasteriskMatch13.15.0rc2
ORdigiumasteriskMatch13.15.0rc3
ORdigiumasteriskMatch13.15.1
ORdigiumasteriskMatch13.16.0
ORdigiumasteriskMatch13.16.0rc1
ORdigiumasteriskMatch13.16.0rc2
ORdigiumasteriskMatch13.17.0
ORdigiumasteriskMatch13.17.0rc1
Node
digiumasteriskMatch14.0
ORdigiumasteriskMatch14.0.0
ORdigiumasteriskMatch14.0.0beta1
ORdigiumasteriskMatch14.0.0beta2
ORdigiumasteriskMatch14.0.0rc1
ORdigiumasteriskMatch14.0.0rc2
ORdigiumasteriskMatch14.0.1
ORdigiumasteriskMatch14.0.2
ORdigiumasteriskMatch14.1
ORdigiumasteriskMatch14.01
ORdigiumasteriskMatch14.1.0
ORdigiumasteriskMatch14.1.1
ORdigiumasteriskMatch14.1.2
ORdigiumasteriskMatch14.02
ORdigiumasteriskMatch14.2
ORdigiumasteriskMatch14.2.0
ORdigiumasteriskMatch14.2.1
ORdigiumasteriskMatch14.3.0
ORdigiumasteriskMatch14.3.0rc1
ORdigiumasteriskMatch14.3.0rc2
ORdigiumasteriskMatch14.3.1
ORdigiumasteriskMatch14.4.0
ORdigiumasteriskMatch14.4.0rc1
ORdigiumasteriskMatch14.4.0rc2
ORdigiumasteriskMatch14.4.0rc3
ORdigiumasteriskMatch14.4.1
ORdigiumasteriskMatch14.5.0
ORdigiumasteriskMatch14.5.0rc1
ORdigiumasteriskMatch14.5.0rc2
ORdigiumasteriskMatch14.6.0
ORdigiumasteriskMatch14.6.0rc1
Node
digiumasteriskMatch11.0.0
ORdigiumasteriskMatch11.0.0beta1
ORdigiumasteriskMatch11.0.0beta2
ORdigiumasteriskMatch11.0.0rc1
ORdigiumasteriskMatch11.0.0rc2
ORdigiumasteriskMatch11.0.1
ORdigiumasteriskMatch11.0.2
ORdigiumasteriskMatch11.1.0
ORdigiumasteriskMatch11.1.0rc1
ORdigiumasteriskMatch11.1.0rc2
ORdigiumasteriskMatch11.1.0rc3
ORdigiumasteriskMatch11.1.1
ORdigiumasteriskMatch11.1.2
ORdigiumasteriskMatch11.2.0rc1
ORdigiumasteriskMatch11.2.1
ORdigiumasteriskMatch11.2.2
ORdigiumasteriskMatch11.4.0rc4
ORdigiumasteriskMatch11.6.0
ORdigiumasteriskMatch11.6.0rc1
ORdigiumasteriskMatch11.6.0rc2
ORdigiumasteriskMatch11.6.1
ORdigiumasteriskMatch11.7.0
ORdigiumasteriskMatch11.7.0rc1
ORdigiumasteriskMatch11.7.0rc2
ORdigiumasteriskMatch11.8.0-
ORdigiumasteriskMatch11.8.0rc1
ORdigiumasteriskMatch11.8.0rc2
ORdigiumasteriskMatch11.8.0rc3
ORdigiumasteriskMatch11.8.1
ORdigiumasteriskMatch11.9.0
ORdigiumasteriskMatch11.9.0rc1
ORdigiumasteriskMatch11.9.0rc2
ORdigiumasteriskMatch11.9.0rc3
ORdigiumasteriskMatch11.10.0
ORdigiumasteriskMatch11.10.0rc1
ORdigiumasteriskMatch11.10.1
ORdigiumasteriskMatch11.10.1rc1
ORdigiumasteriskMatch11.10.2
ORdigiumasteriskMatch11.11.0
ORdigiumasteriskMatch11.11.0rc1
ORdigiumasteriskMatch11.12.0
ORdigiumasteriskMatch11.12.0rc1
ORdigiumasteriskMatch11.12.1
ORdigiumasteriskMatch11.13.0
ORdigiumasteriskMatch11.13.0rc1
ORdigiumasteriskMatch11.13.1
ORdigiumasteriskMatch11.14.0lts
ORdigiumasteriskMatch11.14.0rc1
ORdigiumasteriskMatch11.14.0rc2
ORdigiumasteriskMatch11.14.1
ORdigiumasteriskMatch11.14.2
ORdigiumasteriskMatch11.15.0rc1
ORdigiumasteriskMatch11.15.0rc2
ORdigiumasteriskMatch11.15.1
ORdigiumasteriskMatch11.16.0rc1
ORdigiumasteriskMatch11.17.0rc1
ORdigiumasteriskMatch11.17.1
ORdigiumasteriskMatch11.18.0
ORdigiumasteriskMatch11.18.0rc1
ORdigiumasteriskMatch11.19.0rc1
ORdigiumasteriskMatch11.20.0rc1
ORdigiumasteriskMatch11.21.0rc1
ORdigiumasteriskMatch11.21.0rc2
ORdigiumasteriskMatch11.21.1
ORdigiumasteriskMatch11.21.2
ORdigiumasteriskMatch11.22.0
ORdigiumasteriskMatch11.22.0rc1
ORdigiumasteriskMatch11.23.0
ORdigiumasteriskMatch11.23.0rc1
ORdigiumasteriskMatch11.23.1
ORdigiumasteriskMatch11.24.0
ORdigiumasteriskMatch11.24.1
ORdigiumasteriskMatch11.25.0
ORdigiumasteriskMatch11.25.1
Node
digiumcertified_asteriskMatch11.6cert1
ORdigiumcertified_asteriskMatch11.6cert1_rc1
ORdigiumcertified_asteriskMatch11.6cert1_rc2
ORdigiumcertified_asteriskMatch11.6cert10
ORdigiumcertified_asteriskMatch11.6cert11
ORdigiumcertified_asteriskMatch11.6cert12
ORdigiumcertified_asteriskMatch11.6cert13
ORdigiumcertified_asteriskMatch11.6cert14
ORdigiumcertified_asteriskMatch11.6cert14_rc1
ORdigiumcertified_asteriskMatch11.6cert14_rc2
ORdigiumcertified_asteriskMatch11.6cert15
ORdigiumcertified_asteriskMatch11.6cert16
ORdigiumcertified_asteriskMatch11.6cert2
ORdigiumcertified_asteriskMatch11.6cert3
ORdigiumcertified_asteriskMatch11.6cert4
ORdigiumcertified_asteriskMatch11.6cert5
ORdigiumcertified_asteriskMatch11.6cert6
ORdigiumcertified_asteriskMatch11.6cert7
ORdigiumcertified_asteriskMatch11.6cert8
ORdigiumcertified_asteriskMatch11.6cert9
Node
digiumcertified_asteriskMatch13.13cert1
ORdigiumcertified_asteriskMatch13.13cert1_rc1
ORdigiumcertified_asteriskMatch13.13cert1_rc2
ORdigiumcertified_asteriskMatch13.13cert1_rc3
ORdigiumcertified_asteriskMatch13.13cert1_rc4
ORdigiumcertified_asteriskMatch13.13cert2
ORdigiumcertified_asteriskMatch13.13cert3
ORdigiumcertified_asteriskMatch13.13cert4
Related
osv
osv
asterisk - security update
2017-10-05 00:00:00
CVE-2017-14100
2017-09-02 16:29:00
asterisk - security update
2017-09-04 00:00:00
debian
debian
[SECURITY] [DLA 1122-1] asterisk security update
2017-10-05 13:03:23
[SECURITY] [DSA 3964-1] asterisk security update
2017-09-04 21:32:18
openvas
openvas
Debian: Security Advisory (DLA-1122-1)
2018-02-06 00:00:00
Debian: Security Advisory (DSA-3964-1)
2017-09-03 00:00:00
Asterisk Multiple Vulnerabilities (Aug 2017)
2017-09-01 00:00:00
nessus
nessus
Debian DLA-1122-1 : asterisk security update
2017-10-06 00:00:00
Debian DSA-3964-1 : asterisk - security update
2017-09-05 00:00:00
checkpoint_advisories
checkpoint_advisories
Digium Asterisk app_minivm Caller-ID Command Execution (CVE-2017-14100)
2017-10-08 00:00:00
debiancve
debiancve
CVE-2017-14100
2017-09-02 16:29:00
cvelist
cvelist
CVE-2017-14100
2017-09-02 16:00:00
nvd
nvd
CVE-2017-14100
2017-09-02 16:29:00
ubuntucve
ubuntucve
CVE-2017-14100
2017-09-02 00:00:00
prion
prion
Command injection
2017-09-02 16:29:00
freebsd
freebsd
gentoo
gentoo
Asterisk: Multiple vulnerabilities
2017-10-29 00:00:00
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.5 High
AI Score
Confidence
High
0.961 High
EPSS
Percentile
99.5%
Related for CVE-2017-14100