Asterisk CVE-2012-4737 Access Rule Remote Security Bypass Vulnerability

Bugtraq ID:	55335
Class:	Design Error
CVE:	CVE-2012-4737
Remote:	Yes
Local:	No
Published:	Aug 30 2012 12:00AM
Updated:	Sep 26 2012 04:40PM
Credit:	Alan Frisch
Vulnerable:	Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Asterisk Certified Asterisk 1.8.11-cert2 Asterisk Certified Asterisk 1.8.11-cert1 Asterisk Asterisk Open Source 1.8.3.1 Asterisk Asterisk Business Edition C.3.7.4 Asterisk Asterisk Business Edition C.3.7.3 Asterisk Asterisk Business Edition C.3.6.4 Asterisk Asterisk Business Edition C.3.6.3 Asterisk Asterisk Business Edition C.3.6.2 Asterisk Asterisk Business Edition C.3.3.2 Asterisk Asterisk Business Edition C.3.2 3 Asterisk Asterisk Business Edition C.3.2 2 Asterisk Asterisk Business Edition C.3.1.0 Asterisk Asterisk Business Edition C.3.1 1
Not Vulnerable:

Asterisk CVE-2012-4737 Access Rule Remote Security Bypass Vulnerability

Asterisk is prone to a security-bypass vulnerability.

Attackers can exploit this issue to bypass access control list (ACL) rules, which may lead to other attacks.

Asterisk CVE-2012-4737 Access Rule Remote Security Bypass Vulnerability

Attackers can exploit this issue through a browser.

Asterisk CVE-2012-4737 Access Rule Remote Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for details.

Asterisk CVE-2012-4737 Access Rule Remote Security Bypass Vulnerability

References:

• Asterisk Homepage (Asterisk)