Asterisk - Unauthorized Command Execution
Summary
DLA-1122-1: asterisk - security update. Affects asterisk versions < 1:1.8.13.1~dfsg1-3+deb7u7. Fixed in 1:1.8.13.1~dfsg1-3+deb7u7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Asterisk is an Open Source PBX and telephony toolkit used for building communication applications. It provides various features like voice over IP, conference calling, and interactive voice response. The app_minivm module in Asterisk has a configuration option called externnotify, which is executed by the MinivmNotify dialplan application. This application uses caller-id name and number as part of a string passed to the OS shell for execution. However, due to a vulnerability, a crafted caller-id name or number can lead to arbitrary shell command injection.
Vulnerability Detail
The vulnerability in Asterisk allows an attacker to inject arbitrary shell commands by manipulating the caller-id name or number. Since the caller-id name and number can come from an untrusted source, an attacker can exploit this to execute unauthorized commands on the system. This can lead to various consequences, including unauthorized access, data leakage, and system compromise.
How To Fix
Minimum fixed version
1:1.8.13.1~dfsg1-3+deb7u7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is crucial to ensure that the Asterisk configuration is properly secured and that the caller-id name and number are validated before being used in any shell commands.
Conclusion
The vulnerability in Asterisk allows for unauthorized command execution through the app_minivm module. It is crucial to upgrade to the patched version to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for asterisk →
FAQ
Asterisk is an Open Source PBX and telephony toolkit used for building communication applications.
The app_minivm module is a part of Asterisk that provides functionality related to voicemail and mailbox management.
The vulnerability occurs due to the app_minivm module's use of caller-id name and number without proper validation, allowing for arbitrary shell command injection.
The vulnerability can lead to unauthorized command execution, which may result in unauthorized access, data leakage, and system compromise.
To fix this vulnerability, you should upgrade the Asterisk package to version 1:1.8.13.1~dfsg1-3+deb7u7 or later.
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
