Unscored severity · published Aug 31, 2012
CVE-2012-2186
Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk…
–
CVSS
3.6%
EPSS
No
On KEV
Description
Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 allows remote authenticated users to execute arbitrary commands by leveraging originate privileges and providing an ExternalIVR value in an AMI Originate action.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Asterisk · Sangoma
through 1.8.15.0; through 10.7.0 · source: NVD
BE
Business Edition · Asterisk
through c.3.7.5; c.3.0 · source: NVD
CA
Certified Asterisk · Asterisk
through 1.8.11; 1.8.11; 1.8.11; 1.8.11; 1.8.11; 1.8.11 · source: NVD
DI
Digiumphones · Asterisk
through 10.7.0 · source: NVD
OS
Open Source · Asterisk
1.8.0; 1.8.0; 1.8.0; 1.8.0; 1.8.0; 1.8.0; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2186
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2186
Patch
http://downloads.asterisk.org/pub/security/AST-2012-012.html
secunia.com
http://secunia.com/advisories/50687
secunia.com
http://secunia.com/advisories/50756
www.debian.org
http://www.debian.org/security/2012/dsa-2550
www.securitytracker.com
http://www.securitytracker.com/id?1027460
More from Business Edition
–
CVE-2013-2264
The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business…