Unscored severity · published Apr 30, 2012
CVE-2012-2414
main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before…
–
CVSS
2.7%
EPSS
No
On KEV
Description
main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements, which allows remote authenticated users to execute arbitrary commands via (1) the originate action in the MixMonitor application, (2) the SHELL and EVAL functions in the GetVar manager action, or (3) the SHELL and EVAL functions in the Status manager action.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Open Source · Asterisk
1.6.2.0; 1.6.2.0; 1.6.2.0; 1.6.2.0; 1.6.2.0; 1.6.2.0; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2414
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2414
Patch
http://downloads.asterisk.org/pub/security/AST-2012-004.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079759.html
osvdb.org
http://osvdb.org/81454
secunia.com
http://secunia.com/advisories/48891
secunia.com
http://secunia.com/advisories/48941
www.debian.org
http://www.debian.org/security/2012/dsa-2460
More from Open Source
–
CVE-2013-2686
main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and…
–
CVE-2013-2685
Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows remote attackers to execute arbitrary code via a long…
–
CVE-2013-2264
The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business…
–
CVE-2012-2186
Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk…
–
CVE-2012-2948
chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1…