Asterisk Voicemail Unauthorized Access Vulnerability
BID:15336
Info
Asterisk Voicemail Unauthorized Access Vulnerability
| Bugtraq ID: | 15336 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-3559 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 07 2005 12:00AM |
| Updated: | Dec 05 2006 04:54PM |
| Credit: | Adam Pointon of Assurance.com.au is credited with the discovery of this vulnerability. |
| Vulnerable: |
Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0 Asterisk@Home Asterisk@Home 2.0 -beta4 Asterisk@Home Asterisk@Home 1.5 Asterisk Asterisk 1.2 .0-beta1 Asterisk Asterisk 1.0.9 Asterisk Asterisk 1.0.8 Asterisk Asterisk 1.0.7 Asterisk Asterisk 0.9 .0 Asterisk Asterisk 0.7.2 Asterisk Asterisk 0.7.1 Asterisk Asterisk 0.7 .0 Asterisk Asterisk 0.4 Asterisk Asterisk 0.3 Asterisk Asterisk 0.2 Asterisk Asterisk 0.1.11 Asterisk Asterisk 0.1.9 -1 Asterisk Asterisk 0.1.9 Asterisk Asterisk 0.1.8 Asterisk Asterisk 0.1.7 |
| Not Vulnerable: |
Asterisk Asterisk 1.2 .0-beta2 |
Discussion
Asterisk Voicemail Unauthorized Access Vulnerability
Asterisk is prone to an unauthorized-access vulnerability. This issue is due to a failure in the application to properly verify user-supplied input.
Successful exploitation will grant an attacker access to a victim user's voicemail and to any '.wav/.WAV' files currently on the affected system.
Asterisk is prone to an unauthorized-access vulnerability. This issue is due to a failure in the application to properly verify user-supplied input.
Successful exploitation will grant an attacker access to a victim user's voicemail and to any '.wav/.WAV' files currently on the affected system.
Exploit / POC
Asterisk Voicemail Unauthorized Access Vulnerability
No exploit is required.
The following proof-of-concept URI is available:
http://www.example.org/cgi-bin/vmail.cgi?action=audio&folder=../201/INBOX&mailbox=200&context=default&password=12345&msgid=0001&format=wav
No exploit is required.
The following proof-of-concept URI is available:
http://www.example.org/cgi-bin/vmail.cgi?action=audio&folder=../201/INBOX&mailbox=200&context=default&password=12345&msgid=0001&format=wav
Solution / Fix
Asterisk Voicemail Unauthorized Access Vulnerability
Solution:
The vendor has addressed this issue in Asterisk version 1.2.0-beta2.
Please see the referenced vendor advisories for details on obtaining and applying the appropriate updates.
Asterisk Asterisk 0.1.11
Asterisk Asterisk 0.1.7
Asterisk Asterisk 0.1.8
Asterisk Asterisk 0.1.9
Asterisk Asterisk 0.1.9 -1
Asterisk Asterisk 0.2
Asterisk Asterisk 0.3
Asterisk Asterisk 0.4
Asterisk Asterisk 0.7 .0
Asterisk Asterisk 0.7.1
Asterisk Asterisk 0.7.2
Asterisk Asterisk 0.9 .0
Asterisk Asterisk 1.0.7
Asterisk Asterisk 1.0.8
Asterisk Asterisk 1.0.9
Asterisk Asterisk 1.2 .0-beta1
Solution:
The vendor has addressed this issue in Asterisk version 1.2.0-beta2.
Please see the referenced vendor advisories for details on obtaining and applying the appropriate updates.
Asterisk Asterisk 0.1.11
-
Debian asterisk_0.1.11-3woody1_alpha.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_0.1.1 1-3woody1_alpha.deb -
Debian asterisk_0.1.11-3woody1_arm.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_0.1.1 1-3woody1_arm.deb -
Debian asterisk_0.1.11-3woody1_hppa.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_0.1.1 1-3woody1_hppa.deb -
Debian asterisk_0.1.11-3woody1_i386.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_0.1.1 1-3woody1_i386.deb -
Debian asterisk_0.1.11-3woody1_ia64.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_0.1.1 1-3woody1_ia64.deb -
Debian asterisk_0.1.11-3woody1_m68k.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_0.1.1 1-3woody1_m68k.deb -
Debian asterisk_0.1.11-3woody1_mipsel.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_0.1.1 1-3woody1_mipsel.deb -
Debian asterisk_0.1.11-3woody1_powerpc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_0.1.1 1-3woody1_powerpc.deb -
Debian asterisk_0.1.11-3woody1_s390.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_0.1.1 1-3woody1_s390.deb -
Debian asterisk_0.1.11-3woody1_sparc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_0.1.1 1-3woody1_sparc.deb
Asterisk Asterisk 0.1.7
-
Asterisk asterisk-1.2.0-beta2.tar.gz
http://ftp.digium.com/pub/asterisk/asterisk-1.2.0-beta2.tar.gz
Asterisk Asterisk 0.1.8
-
Asterisk asterisk-1.2.0-beta2.tar.gz
http://ftp.digium.com/pub/asterisk/asterisk-1.2.0-beta2.tar.gz
Asterisk Asterisk 0.1.9
-
Asterisk asterisk-1.2.0-beta2.tar.gz
http://ftp.digium.com/pub/asterisk/asterisk-1.2.0-beta2.tar.gz
Asterisk Asterisk 0.1.9 -1
-
Asterisk asterisk-1.2.0-beta2.tar.gz
http://ftp.digium.com/pub/asterisk/asterisk-1.2.0-beta2.tar.gz
Asterisk Asterisk 0.2
-
Asterisk asterisk-1.2.0-beta2.tar.gz
http://ftp.digium.com/pub/asterisk/asterisk-1.2.0-beta2.tar.gz
Asterisk Asterisk 0.3
-
Asterisk asterisk-1.2.0-beta2.tar.gz
http://ftp.digium.com/pub/asterisk/asterisk-1.2.0-beta2.tar.gz
Asterisk Asterisk 0.4
-
Asterisk asterisk-1.2.0-beta2.tar.gz
http://ftp.digium.com/pub/asterisk/asterisk-1.2.0-beta2.tar.gz
Asterisk Asterisk 0.7 .0
-
Asterisk asterisk-1.2.0-beta2.tar.gz
http://ftp.digium.com/pub/asterisk/asterisk-1.2.0-beta2.tar.gz
Asterisk Asterisk 0.7.1
-
Asterisk asterisk-1.2.0-beta2.tar.gz
http://ftp.digium.com/pub/asterisk/asterisk-1.2.0-beta2.tar.gz
Asterisk Asterisk 0.7.2
-
Asterisk asterisk-1.2.0-beta2.tar.gz
http://ftp.digium.com/pub/asterisk/asterisk-1.2.0-beta2.tar.gz
Asterisk Asterisk 0.9 .0
-
Asterisk asterisk-1.2.0-beta2.tar.gz
http://ftp.digium.com/pub/asterisk/asterisk-1.2.0-beta2.tar.gz
Asterisk Asterisk 1.0.7
-
Asterisk asterisk-1.2.0-beta2.tar.gz
http://ftp.digium.com/pub/asterisk/asterisk-1.2.0-beta2.tar.gz -
Debian asterisk-config_1.0.7.dfsg.1-2sarge2_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.0.7.dfsg.1-2sarge2_all.deb -
Debian asterisk-dev_1.0.7.dfsg.1-2sarge2_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .0.7.dfsg.1-2sarge2_all.deb -
Debian asterisk-doc_1.0.7.dfsg.1-2sarge2_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .0.7.dfsg.1-2sarge2_all.deb -
Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge2_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge2_alpha.deb -
Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge2_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge2_amd64.deb -
Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge2_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge2_arm.deb -
Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge2_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge2_hppa.deb -
Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge2_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge2_i386.deb -
Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge2_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge2_ia64.deb -
Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge2_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge2_m68k.deb -
Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge2_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge2_mips.deb -
Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge2_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge2_mipsel.deb -
Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge2_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge2_powerpc.deb -
Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge2_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge2_s390.deb -
Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge2_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge2_sparc.deb -
Debian asterisk-h323_1.0.7.dfsg.1-2sarge2_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge2_alpha.deb -
Debian asterisk-h323_1.0.7.dfsg.1-2sarge2_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge2_amd64.deb -
Debian asterisk-h323_1.0.7.dfsg.1-2sarge2_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge2_arm.deb -
Debian asterisk-h323_1.0.7.dfsg.1-2sarge2_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge2_hppa.deb -
Debian asterisk-h323_1.0.7.dfsg.1-2sarge2_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge2_i386.deb -
Debian asterisk-h323_1.0.7.dfsg.1-2sarge2_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge2_ia64.deb -
Debian asterisk-h323_1.0.7.dfsg.1-2sarge2_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge2_m68k.deb -
Debian asterisk-h323_1.0.7.dfsg.1-2sarge2_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge2_mips.deb -
Debian asterisk-h323_1.0.7.dfsg.1-2sarge2_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge2_mipsel.deb -
Debian asterisk-h323_1.0.7.dfsg.1-2sarge2_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge2_powerpc.deb -
Debian asterisk-h323_1.0.7.dfsg.1-2sarge2_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge2_s390.deb -
Debian asterisk-h323_1.0.7.dfsg.1-2sarge2_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge2_sparc.deb -
Debian asterisk-sounds-main_1.0.7.dfsg.1-2sarge2_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.0.7.dfsg.1-2sarge2_all.deb -
Debian asterisk-web-vmail_1.0.7.dfsg.1-2sarge2_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-web-v mail_1.0.7.dfsg.1-2sarge2_all.deb -
Debian asterisk_1.0.7.dfsg.1-2sarge2_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge2_alpha.deb -
Debian asterisk_1.0.7.dfsg.1-2sarge2_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge2_amd64.deb -
Debian asterisk_1.0.7.dfsg.1-2sarge2_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge2_arm.deb -
Debian asterisk_1.0.7.dfsg.1-2sarge2_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge2_hppa.deb -
Debian asterisk_1.0.7.dfsg.1-2sarge2_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge2_i386.deb -
Debian asterisk_1.0.7.dfsg.1-2sarge2_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge2_ia64.deb -
Debian asterisk_1.0.7.dfsg.1-2sarge2_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge2_m68k.deb -
Debian asterisk_1.0.7.dfsg.1-2sarge2_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge2_mips.deb -
Debian asterisk_1.0.7.dfsg.1-2sarge2_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge2_mipsel.deb -
Debian asterisk_1.0.7.dfsg.1-2sarge2_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge2_powerpc.deb -
Debian asterisk_1.0.7.dfsg.1-2sarge2_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge2_s390.deb -
Debian asterisk_1.0.7.dfsg.1-2sarge2_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge2_sparc.deb
Asterisk Asterisk 1.0.8
-
Asterisk asterisk-1.2.0-beta2.tar.gz
http://ftp.digium.com/pub/asterisk/asterisk-1.2.0-beta2.tar.gz
Asterisk Asterisk 1.0.9
-
Asterisk asterisk-1.2.0-beta2.tar.gz
http://ftp.digium.com/pub/asterisk/asterisk-1.2.0-beta2.tar.gz
Asterisk Asterisk 1.2 .0-beta1
-
Asterisk asterisk-1.2.0-beta2.tar.gz
http://ftp.digium.com/pub/asterisk/asterisk-1.2.0-beta2.tar.gz
References
Asterisk Voicemail Unauthorized Access Vulnerability
References:
References:
- Asterisk Homepage (Asterisk)
- Asterisk@Home Homepage (Asterisk@Home)
- Asterisk vmail.cgi vulnerability (Assurance.com.au)