CVE Feed

    Dashboard / CVE / CVE-2012-2414

    CVE-2012-2414

    main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements, which allows remote authenticated users to execute arbitrary commands via (1) the originate action in the MixMonitor application, (2) the SHELL and EVAL functions in the GetVar manager action, or (3) the SHELL and EVAL functions in the Status manager action.

    Published:Apr 30, 2012
    Last Modified:Apr 11, 2025
    EPS:Apr 30, 2012
    EPSS Score:0.04278
    CVSS Score:6.5

    Affected Products

    Vendor
    Asterisk
    Product
    Open Source

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-287 Improper Authentication

    Related CVEs

    CVE-2013-2685 (CVSS 7.5) — Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows re…
    CVE-2013-2264 (CVSS 5) — The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.…
    CVE-2013-2686 (CVSS 5) — main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x be…
    CVE-2012-2186 (CVSS 9) — Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x be…
    CVE-2012-2948 (CVSS 4) — chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 an…
    CVE-2012-2416 (CVSS 6.5) — chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.11.1 and 10.x before 10.3.1 and …
    CVE-2012-2415 (CVSS 6.5) — Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x befor…
    CVE-2012-0885 (CVSS 4.3) — chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is us…
    CVE-2011-4063 (CVSS 6.8) — chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 d…
    CVE-2009-2346 (CVSS 7.8) — The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x b…

    References

    http://downloads.asterisk.org/pub/security/AST-2012-004.html
    http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079759.html
    http://osvdb.org/81454
    http://secunia.com/advisories/48891
    http://secunia.com/advisories/48941
    http://www.debian.org/security/2012/dsa-2460
    http://www.securityfocus.com/bid/53206
    http://www.securitytracker.com/id?1026961
    https://exchange.xforce.ibmcloud.com/vulnerabilities/75100
    http://downloads.asterisk.org/pub/security/AST-2012-004.html
    http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079759.html
    http://osvdb.org/81454
    http://secunia.com/advisories/48891
    http://secunia.com/advisories/48941
    http://www.debian.org/security/2012/dsa-2460
    http://www.securityfocus.com/bid/53206
    http://www.securitytracker.com/id?1026961
    https://exchange.xforce.ibmcloud.com/vulnerabilities/75100

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High