digium asterisk 1.6.2.4 Invalid parsing of ACL rules

2010-04-06 / 2010-04-07
Credit: Asterisk Security Team
Risk: Low
Local: No
Remote: Yes
CVE: CVE-2010-1224
CWE: CWE-264


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

Asterisk Project Security Advisory - AST-2010-003 +----------------------------------------------------------------------- -+ | Product | Asterisk | |--------------------+-------------------------------------------------- -| | Summary | Invalid parsing of ACL rules can compromise | | | security | |--------------------+-------------------------------------------------- -| | Nature of Advisory | Unauthorized access to system | |--------------------+-------------------------------------------------- -| | Susceptibility | Remote Unauthenticated Sessions | |--------------------+-------------------------------------------------- -| | Severity | Moderate | |--------------------+-------------------------------------------------- -| | Exploits Known | No | |--------------------+-------------------------------------------------- -| | Reported On | Feb 24, 2010 | |--------------------+-------------------------------------------------- -| | Reported By | Mark Michelson | |--------------------+-------------------------------------------------- -| | Posted On | Feb 25, 2010 | |--------------------+-------------------------------------------------- -| | Last Updated On | February 25, 2010 | |--------------------+-------------------------------------------------- -| | Advisory Contact | Mark Michelson < mmichelson AT digium DOT com > | |--------------------+-------------------------------------------------- -| | CVE Name | | +----------------------------------------------------------------------- -+ +----------------------------------------------------------------------- -+ | Description | Host access rules using "permit=" and "deny=" | | | configurations behave unpredictably if the CIDR notation | | | "/0" is used. Depending on the system's behavior, this | | | may act as desired, but in other cases it might not, | | | thereby allowing access from hosts that should be | | | denied. | | | | | | Note that even if an unauthorized host is allowed access | | | due to this exploit, authentication measures still in | | | place would prevent further unauthorized access. | | | | | | Note also that there is a workaround for this problem, | | | which is to use the dotted-decimal format "/0.0.0.0" | | | instead of CIDR notation. The bug does not exist when | | | using this format. In addition, this format is what is | | | used in Asterisk's sample configuration files. | +----------------------------------------------------------------------- -+ +----------------------------------------------------------------------- -+ | Resolution | Code has been corrected to behave consistently on all | | | systems when "/0" is used. | +----------------------------------------------------------------------- -+ +----------------------------------------------------------------------- -+ | Affected Versions | |----------------------------------------------------------------------- -| | Product | Release | | | | Series | | |----------------------------+---------+-------------------------------- -| | Asterisk Open Source | 1.2.x | Unaffected | |----------------------------+---------+-------------------------------- -| | Asterisk Open Source | 1.4.x | Unaffected | |----------------------------+---------+-------------------------------- -| | Asterisk Open Source | 1.6.x | All 1.6.0, 1.6.1 and 1.6.2 | | | | releases | |----------------------------+---------+-------------------------------- -| | Asterisk Addons | 1.2.x | Unaffected | |----------------------------+---------+-------------------------------- -| | Asterisk Addons | 1.4.x | Unaffected | |----------------------------+---------+-------------------------------- -| | Asterisk Addons | 1.6.x | Unaffected | |----------------------------+---------+-------------------------------- -| | Asterisk Business Edition | A.x.x | Unaffected | |----------------------------+---------+-------------------------------- -| | Asterisk Business Edition | B.x.x | Unaffected | |----------------------------+---------+-------------------------------- -| | Asterisk Business Edition | C.x.x | Unaffected | |----------------------------+---------+-------------------------------- -| | AsteriskNOW | 1.5 | Unaffected | |----------------------------+---------+-------------------------------- -| | s800i (Asterisk Appliance) | 1.2.x | Unaffected | +----------------------------------------------------------------------- -+ +----------------------------------------------------------------------- -+ | Corrected In | |----------------------------------------------------------------------- -| | Product | Release | |------------------------------------+---------------------------------- -| | Asterisk | 1.6.0.25 | |------------------------------------+---------------------------------- -| | Asterisk | 1.6.1.17 | |------------------------------------+---------------------------------- -| | Asterisk | 1.6.2.5 | +----------------------------------------------------------------------- -+ +----------------------------------------------------------------------- --+ | Patches | |----------------------------------------------------------------------- --| | URL |Branch| |------------------------------------------------------------------+---- --| |http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff|1.6. 0 | |------------------------------------------------------------------+---- --| |http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff|1.6. 1 | |------------------------------------------------------------------+---- --| |http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.2.diff|1.6. 2 | +----------------------------------------------------------------------- --+ +----------------------------------------------------------------------- -+ | Links | | +----------------------------------------------------------------------- -+ +----------------------------------------------------------------------- -+ | Asterisk Project Security Advisories are posted at | | http://www.asterisk.org/security | | | | This document may be superseded by later versions; if so, the latest | | version will be posted at | | http://downloads.digium.com/pub/security/AST-2010-003.pdf and | | http://downloads.digium.com/pub/security/AST-2010-003.html | +----------------------------------------------------------------------- -+ +----------------------------------------------------------------------- -+ | Revision History | |----------------------------------------------------------------------- -| | Date | Editor | Revisions Made | |-------------------+----------------------+---------------------------- -| | Feb 24, 2010 | Mark Michelson | Initial Advisory | +----------------------------------------------------------------------- -+ Asterisk Project Security Advisory - AST-2010-003 Copyright (c) 2010 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form.

References:

http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.2.diff
http://xforce.iss.net/xforce/xfdb/56552
http://www.vupen.com/english/advisories/2010/0475
http://www.securityfocus.com/bid/38424
http://www.securityfocus.com/archive/1/archive/1/509757/100/0/threaded
http://secunia.com/advisories/38752
http://osvdb.org/62588
http://downloads.asterisk.org/pub/security/AST-2010-003.html
http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff
http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top