Asterisk CIDR Notation in Access Rule Remote Security Bypass Vulnerability

Bugtraq ID:	38424
Class:	Design Error
CVE:	CVE-2010-1224
Remote:	Yes
Local:	No
Published:	Feb 25 2010 12:00AM
Updated:	May 07 2015 05:20PM
Credit:	Mark Michelson
Vulnerable:	Asterisk Asterisk 1.6.4 Asterisk Asterisk 1.6.3 Asterisk Asterisk 1.6.2 Asterisk Asterisk 1.6.1 11 Asterisk Asterisk 1.6.1 0-rc2 Asterisk Asterisk 1.6.1 0-rc1 Asterisk Asterisk 1.6.1 .9 Asterisk Asterisk 1.6.1 .6 Asterisk Asterisk 1.6.1 .5 Asterisk Asterisk 1.6.1 Asterisk Asterisk 1.6 beta6 Asterisk Asterisk 1.6 6 Asterisk Asterisk 1.6 19 Asterisk Asterisk 1.6 .8 Asterisk Asterisk 1.6 .17 Asterisk Asterisk 1.6.2.2 Asterisk Asterisk 1.6.1.8 Asterisk Asterisk 1.6.1.7 Asterisk Asterisk 1.6.1.14 Asterisk Asterisk 1.6.0.3 Asterisk Asterisk 1.6.0.22 Asterisk Asterisk 1.6.0.15 Asterisk Asterisk 1.6.0.14 Asterisk Asterisk 1.6
Not Vulnerable:	Asterisk Asterisk 1.6.2 .5 Asterisk Asterisk 1.6.1 .17 Asterisk Asterisk 1.6 .25

Asterisk CIDR Notation in Access Rule Remote Security Bypass Vulnerability

Asterisk is prone to a security-bypass vulnerability.

Attackers can exploit this issue to bypass access control list (ACL) rules, which may lead to other attacks.

Asterisk CIDR Notation in Access Rule Remote Security Bypass Vulnerability

Attackers can use readily available utilities to exploit this issue.

Asterisk CIDR Notation in Access Rule Remote Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for details.


Asterisk Asterisk 1.6.0.3

• Asterisk AST-2010-003-1.6.0.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff

Asterisk Asterisk 1.6.0.15

• Asterisk AST-2010-003-1.6.0.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff

Asterisk Asterisk 1.6

• Asterisk AST-2010-003-1.6.0.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff

Asterisk Asterisk 1.6.0.14

• Asterisk AST-2010-003-1.6.0.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff

Asterisk Asterisk 1.6.2.2

• Asterisk AST-2010-003-1.6.2.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.2.diff

Asterisk Asterisk 1.6.0.22

• Asterisk AST-2010-003-1.6.0.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff

Asterisk Asterisk 1.6.1.8

• Asterisk AST-2010-003-1.6.1.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff

Asterisk Asterisk 1.6.1.14

• Asterisk AST-2010-003-1.6.1.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff

Asterisk Asterisk 1.6.1.7

• Asterisk AST-2010-003-1.6.1.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff

Asterisk Asterisk 1.6 .8

• Asterisk AST-2010-003-1.6.0.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff

Asterisk Asterisk 1.6 19

• Asterisk AST-2010-003-1.6.0.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff

Asterisk Asterisk 1.6 beta6

• Asterisk AST-2010-003-1.6.0.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff

Asterisk Asterisk 1.6 6

• Asterisk AST-2010-003-1.6.0.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff

Asterisk Asterisk 1.6 .17

• Asterisk AST-2010-003-1.6.0.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff

Asterisk Asterisk 1.6.1 .6

• Asterisk AST-2010-003-1.6.1.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff

Asterisk Asterisk 1.6.1 11

• Asterisk AST-2010-003-1.6.1.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff

Asterisk Asterisk 1.6.1 0-rc2

• Asterisk AST-2010-003-1.6.1.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff

Asterisk Asterisk 1.6.1 0-rc1

• Asterisk AST-2010-003-1.6.1.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff

Asterisk Asterisk 1.6.1

• Asterisk AST-2010-003-1.6.1.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff

Asterisk Asterisk 1.6.1 .5

• Asterisk AST-2010-003-1.6.1.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff

Asterisk Asterisk 1.6.1 .9

• Asterisk AST-2010-003-1.6.1.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff

Asterisk Asterisk 1.6.2

• Asterisk AST-2010-003-1.6.2.diff
  http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.2.diff

Asterisk CIDR Notation in Access Rule Remote Security Bypass Vulnerability

References:

• Asterisk Homepage (Asterisk)
  
• AST-2010-003: Invalid parsing of ACL rules can compromise security (Asterisk)