CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:C/I:C/A:N
EPSS
Percentile
91.2%
Asterisk is an open source telephony engine and tool kit.
Asterisk upstream developers reported multiple vulnerabilities:
Remote authenticated attackers could send specially crafted data to Asterisk to execute arbitrary SQL commands and compromise the administrative database. Remote unauthenticated attackers could bypass authentication using a valid username to hijack other userโs sessions, and establish sessions on the SIP channel without authentication.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.2.27"
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Gentoo | any | all | net-misc/asterisk | <ย 1.2.27 | UNKNOWN |