Asterisk Manager Interface Arbitrary Command Execution Security Bypass Vulnerability

Bugtraq ID:	47537
Class:	Access Validation Error
CVE:	CVE-2011-1599
Remote:	Yes
Local:	No
Published:	Apr 21 2011 12:00AM
Updated:	Apr 13 2015 09:36PM
Credit:	Mark Murawski
Vulnerable:	Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Asterisk Asterisk Business Edition C.3.6.3 Asterisk Asterisk Business Edition C.3.6.2 Asterisk Asterisk Business Edition C.3.3.2 Asterisk Asterisk Business Edition C.3.2 3 Asterisk Asterisk Business Edition C.3.2 2 Asterisk Asterisk Business Edition C.3.1.0 Asterisk Asterisk Business Edition C.3.1 1 Asterisk Asterisk Business Edition C.2.4.3 Asterisk Asterisk Business Edition C.2.4.2 Asterisk Asterisk Business Edition C.2.4 6 Asterisk Asterisk Business Edition C.2.4 5 Asterisk Asterisk Business Edition C.2.3.3 Asterisk Asterisk Business Edition C.2.3 .2 Asterisk Asterisk Business Edition C.2.3 Asterisk Asterisk Business Edition C.2.1.2.1 Asterisk Asterisk Business Edition C.1.8.1 Asterisk Asterisk Business Edition C.1.6.2 Asterisk Asterisk Business Edition C.1.6.1 Asterisk Asterisk Business Edition C.1.6 Asterisk Asterisk Business Edition C.1.10.5 Asterisk Asterisk Business Edition C.1.10.4 Asterisk Asterisk Business Edition C.1.10.3 Asterisk Asterisk Business Edition C Asterisk Asterisk 1.8.2 4 Asterisk Asterisk 1.8.1 Asterisk Asterisk 1.8 Asterisk Asterisk 1.6.2 16.2 Asterisk Asterisk 1.6.2 .5 Asterisk Asterisk 1.6.2 Asterisk Asterisk 1.6.1 22 Asterisk Asterisk 1.6.1 11 Asterisk Asterisk 1.6.1 0-rc2 Asterisk Asterisk 1.6.1 0-rc1 Asterisk Asterisk 1.6.1 .9 Asterisk Asterisk 1.6.1 .6 Asterisk Asterisk 1.6.1 .5 Asterisk Asterisk 1.6.1 .17 Asterisk Asterisk 1.6.1 Asterisk Asterisk 1.4.39 2 Asterisk Asterisk 1.4.27 1 Asterisk Asterisk 1.4.26 .3 Asterisk Asterisk 1.4.26 Asterisk Asterisk 1.4.24 .1 Asterisk Asterisk 1.4.24 Asterisk Asterisk 1.4.23 .2 Asterisk Asterisk 1.4.23 .1 Asterisk Asterisk 1.4.23 Asterisk Asterisk 1.4.22 Asterisk Asterisk 1.4.19 .1 Asterisk Asterisk 1.4.19 -rc3 Asterisk Asterisk 1.4.19 Asterisk Asterisk 1.4.18 Asterisk Asterisk 1.4.17 Asterisk Asterisk 1.4.16 Asterisk Asterisk 1.4.15 Asterisk Asterisk 1.4.14 Asterisk Asterisk 1.4.13 Asterisk Asterisk 1.4.12 Asterisk Asterisk 1.4.11 Asterisk Asterisk 1.4.10 Asterisk Asterisk 1.4.9 Asterisk Asterisk 1.4.8 Asterisk Asterisk 1.4.7 Asterisk Asterisk 1.4.6 Asterisk Asterisk 1.4.5 Asterisk Asterisk 1.4.4 Asterisk Asterisk 1.4.3 Asterisk Asterisk 1.4.2 Asterisk Asterisk 1.4.1 Asterisk Asterisk 1.8.3.1 Asterisk Asterisk 1.8.2.1 Asterisk Asterisk 1.8.1.2 Asterisk Asterisk 1.8 Asterisk Asterisk 1.6.2.2 Asterisk Asterisk 1.6.2.17.1 Asterisk Asterisk 1.6.2.16.1 Asterisk Asterisk 1.6.2.15.1 Asterisk Asterisk 1.6.1.8 Asterisk Asterisk 1.6.1.7 Asterisk Asterisk 1.6.1.23 Asterisk Asterisk 1.6.1.21 Asterisk Asterisk 1.6.1.14 Asterisk Asterisk 1.4.39.1 Asterisk Asterisk 1.4.38.1 Asterisk Asterisk 1.4.26.2 Asterisk Asterisk 1.4.26.1 Asterisk Asterisk 1.4.22.1 Asterisk Asterisk 1.4.21.2 Asterisk Asterisk 1.4.18.1
Not Vulnerable:	Asterisk Asterisk Business Edition C.3.6.4 Asterisk Asterisk 1.8.3.3 Asterisk Asterisk 1.6.2.17.3 Asterisk Asterisk 1.6.1.25 Asterisk Asterisk 1.4.40.1

Asterisk Manager Interface Arbitrary Command Execution Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Asterisk Manager Interface Arbitrary Command Execution Security Bypass Vulnerability

References:

• Asterisk Homepage (Asterisk)
  
• Asterisk Project Security Advisory - AST-2011-006 (Asterisk)