Asterisk Dialplan '${EXTEN}' Variable String Injection Vulnerability

Bugtraq ID:	38314
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 16 2010 12:00AM
Updated:	Apr 13 2015 10:24PM
Credit:	Hans Petter Selasky
Vulnerable:	Asterisk Asterisk Business Edition C.3.3.2 Asterisk Asterisk Business Edition C.3.2 3 Asterisk Asterisk Business Edition C.3.2 2 Asterisk Asterisk Business Edition C.3.1.0 Asterisk Asterisk Business Edition C.3.1 1 Asterisk Asterisk Business Edition C.2.4.3 Asterisk Asterisk Business Edition C.2.4.2 Asterisk Asterisk Business Edition C.2.4 6 Asterisk Asterisk Business Edition C.2.4 5 Asterisk Asterisk Business Edition C.2.3.3 Asterisk Asterisk Business Edition C.2.3 .2 Asterisk Asterisk Business Edition C.2.3 Asterisk Asterisk Business Edition C.2.1.2.1 Asterisk Asterisk Business Edition C.1.8.1 Asterisk Asterisk Business Edition C.1.6.2 Asterisk Asterisk Business Edition C.1.6.1 Asterisk Asterisk Business Edition C.1.6 Asterisk Asterisk Business Edition C.1.10.5 Asterisk Asterisk Business Edition C.1.10.4 Asterisk Asterisk Business Edition C.1.10.3 Asterisk Asterisk Business Edition C.1.0-beta8 Asterisk Asterisk Business Edition C.1.0-beta7 Asterisk Asterisk Business Edition C Asterisk Asterisk Business Edition B.2.5.9 Asterisk Asterisk Business Edition B.2.5.8 Asterisk Asterisk Business Edition B.2.5.6 Asterisk Asterisk Business Edition B.2.5.5 Asterisk Asterisk Business Edition B.2.5.4 Asterisk Asterisk Business Edition B.2.5.3 Asterisk Asterisk Business Edition B.2.5.2 Asterisk Asterisk Business Edition B.2.5.10 Asterisk Asterisk Business Edition B.2.5.1 Asterisk Asterisk Business Edition B.2.5 13 Asterisk Asterisk Business Edition B.2.5 12 Asterisk Asterisk Business Edition B.2.5 Asterisk Asterisk Business Edition B.2.3.6 Asterisk Asterisk Business Edition B.2.3.5 Asterisk Asterisk Business Edition B.2.3.4 Asterisk Asterisk Business Edition B.2.3.3 Asterisk Asterisk Business Edition B.2.3.2 Asterisk Asterisk Business Edition B.2.3.1 Asterisk Asterisk Business Edition B.2.2.1 Asterisk Asterisk Business Edition B.2.2.0 Asterisk Asterisk Business Edition B.1.3.3 Asterisk Asterisk Business Edition B.1.3.2 Asterisk Asterisk Business Edition B Asterisk Asterisk 1.6.4 Asterisk Asterisk 1.6.3 Asterisk Asterisk 1.6.2 Asterisk Asterisk 1.6.1 11 Asterisk Asterisk 1.6.1 0-rc2 Asterisk Asterisk 1.6.1 0-rc1 Asterisk Asterisk 1.6.1 .9 Asterisk Asterisk 1.6.1 .6 Asterisk Asterisk 1.6.1 .5 Asterisk Asterisk 1.6.1 Asterisk Asterisk 1.6 beta6 Asterisk Asterisk 1.6 6 Asterisk Asterisk 1.6 19 Asterisk Asterisk 1.6 .8 Asterisk Asterisk 1.6 .17 Asterisk Asterisk 1.4.27 1 Asterisk Asterisk 1.4.26 .3 Asterisk Asterisk 1.4.26 Asterisk Asterisk 1.4.24 .1 Asterisk Asterisk 1.4.24 Asterisk Asterisk 1.4.23 .2 Asterisk Asterisk 1.4.23 .1 Asterisk Asterisk 1.4.23 Asterisk Asterisk 1.4.22 Asterisk Asterisk 1.4.19 .1 Asterisk Asterisk 1.4.19 -rc3 Asterisk Asterisk 1.4.19 Asterisk Asterisk 1.4.18 Asterisk Asterisk 1.4.17 Asterisk Asterisk 1.4.16 Asterisk Asterisk 1.4.15 Asterisk Asterisk 1.4.14 Asterisk Asterisk 1.4.13 Asterisk Asterisk 1.4.12 Asterisk Asterisk 1.4.11 Asterisk Asterisk 1.4.10 Asterisk Asterisk 1.4.9 Asterisk Asterisk 1.4.8 Asterisk Asterisk 1.4.7 Asterisk Asterisk 1.4.6 Asterisk Asterisk 1.4.5 Asterisk Asterisk 1.4.4 Asterisk Asterisk 1.4.3 Asterisk Asterisk 1.4.2 Asterisk Asterisk 1.4.1 Asterisk Asterisk 1.2.37 Asterisk Asterisk 1.2.35 Asterisk Asterisk 1.2.34 Asterisk Asterisk 1.2.33 Asterisk Asterisk 1.2.32 Asterisk Asterisk 1.2.31 Asterisk Asterisk 1.2.30 Asterisk Asterisk 1.2.29 Asterisk Asterisk 1.2.28 Asterisk Asterisk 1.2.27 Asterisk Asterisk 1.2.26 Asterisk Asterisk 1.2.25 Asterisk Asterisk 1.2.24 Asterisk Asterisk 1.2.23 Asterisk Asterisk 1.2.22 Asterisk Asterisk 1.2.21 Asterisk Asterisk 1.2.19 Asterisk Asterisk 1.2.18 Asterisk Asterisk 1.2.17 Asterisk Asterisk 1.2.16 Asterisk Asterisk 1.2.15 Asterisk Asterisk 1.2.14 Asterisk Asterisk 1.2.13 Asterisk Asterisk 1.2.11 Asterisk Asterisk 1.2.10 Asterisk Asterisk 1.2.9 Asterisk Asterisk 1.2.8 Asterisk Asterisk 1.2.7 Asterisk Asterisk 1.2.6 Asterisk Asterisk 1.2.5 Asterisk Asterisk 1.6.2.2 Asterisk Asterisk 1.6.1.8 Asterisk Asterisk 1.6.1.7 Asterisk Asterisk 1.6.1.14 Asterisk Asterisk 1.6.0.3 Asterisk Asterisk 1.6.0.22 Asterisk Asterisk 1.6.0.15 Asterisk Asterisk 1.6.0.14 Asterisk Asterisk 1.6 Asterisk Asterisk 1.4.26.2 Asterisk Asterisk 1.4.26.1 Asterisk Asterisk 1.4.22.1 Asterisk Asterisk 1.4.21.2 Asterisk Asterisk 1.4.18.1 Asterisk Asterisk 1.2.30.4 Asterisk Asterisk 1.2.30.3
Not Vulnerable:	Asterisk Asterisk 1.2.40

Asterisk Dialplan '${EXTEN}' Variable String Injection Vulnerability

Asterisk is prone to a string-injection vulnerability that occurs in a dialplan.

Attackers can exploit this issue to execute unintended calls. This may lead to further attacks.

Asterisk Dialplan '${EXTEN}' Variable String Injection Vulnerability

Attackers can use readily available utilities to exploit this issue.

Asterisk Dialplan '${EXTEN}' Variable String Injection Vulnerability

Solution:
Updates are available. Please see the references for details.

Asterisk Dialplan '${EXTEN}' Variable String Injection Vulnerability

References:

• 0016808: Create example documentation for usage of FILTER() to help secure dialp (Asterisk)
  
• 0016810: Dialplan language does not deal with & character safely (Asterisk)
  
• Asterisk Homepage (Asterisk)
  
• Asterisk Project Security Advisory - AST-2010-002 (Asterisk)