CVE-2010-0685

Severity

50%

Complexity

99%

Confidentiality

48%

The design of the dialplan functionality in Asterisk Open Source 1.2.x, 1.4.x, and 1.6.x; and Asterisk Business Edition B.x.x and C.x.x, when using the ${EXTEN} channel variable and wildcard pattern matches, allows context-dependent attackers to inject strings into the dialplan using metacharacters that are injected when the variable is expanded, as demonstrated using the Dial application to process a crafted SIP INVITE message that adds an unintended outgoing channel leg. NOTE: it could be argued that this is not a vulnerability in Asterisk, but a class of vulnerabilities that can occur in any program that uses this feature without the associated filtering functionality that is already available.

The design of the dialplan functionality in Asterisk Open Source 1.2.x, 1.4.x, and 1.6.x; and Asterisk Business Edition B.x.x and C.x.x, when using the ${EXTEN} channel variable and wildcard pattern matches, allows context-dependent attackers to inject strings into the dialplan using metacharacters that are injected when the variable is expanded, as demonstrated using the Dial application to process a crafted SIP INVITE message that adds an unintended outgoing channel leg. NOTE: it could be argued that this is not a vulnerability in Asterisk, but a class of vulnerabilities that can occur in any program that uses this feature without the associated filtering functionality that is already available.

CVSS 2.0 Base Score 5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N).

Overview

Type

Digium Asterisk

First reported 14 years ago

2010-02-23 20:30:00

Last updated 6 years ago

2018-10-10 19:53:00

Affected Software

Digium Asterisk 1.2.0

1.2.0

Digium Asterisk 1.2.0 beta1

1.2.0

Digium Asterisk 1.2.0 beta2

1.2.0

Digium Asterisk 1.2.0 release candidate 1

1.2.0

Digium Asterisk 1.2.0 release candidate 2

1.2.0

Digium Asterisk 1.2.1

1.2.1

Digium Asterisk 1.2.2

1.2.2

Digium Asterisk 1.2.2-netsec

1.2.2

Digium Asterisk 1.2.3

1.2.3

Digium Asterisk 1.2.3-netsec

1.2.3

Digium Asterisk 1.2.6

1.2.6

Digium Asterisk 1.2.7

1.2.7

Digium Asterisk 1.2.8

1.2.8

Digium Asterisk 1.2.9

1.2.9

Digium Asterisk 1.2.10

1.2.10

Digium Asterisk 1.2.10-netsec

1.2.10

Digium Asterisk 1.2.11

1.2.11

Digium Asterisk 1.2.11-netsec

1.2.11

Digium Asterisk 1.2.12

1.2.12

Digium Asterisk 1.2.12-netsec

1.2.12

Digium Asterisk 1.2.12.1

1.2.12.1

Digium Asterisk 1.2.12.1-netsec

1.2.12.1

Digium Asterisk 1.2.13

1.2.13

Digium Asterisk 1.2.13-netsec

1.2.13

Digium Asterisk 1.2.14

1.2.14

Digium Asterisk 1.2.15

1.2.15

Digium Asterisk 1.2.15-netsec

1.2.15

Digium Asterisk 1.2.16

1.2.16

Digium Asterisk 1.2.16-netsec

1.2.16

Digium Asterisk 1.2.17

1.2.17

Digium Asterisk 1.2.17-netsec

1.2.17

Digium Asterisk 1.2.18

1.2.18

Digium Asterisk 1.2.18-netsec

1.2.18

Digium Asterisk 1.2.19

1.2.19

Digium Asterisk 1.2.19-netsec

1.2.19

Digium Asterisk 1.2.20

1.2.20

Digium Asterisk 1.2.20-netsec

1.2.20

Digium Asterisk 1.2.21

1.2.21

Digium Asterisk 1.2.21-netsec

1.2.21

Digium Asterisk 1.2.21.1

1.2.21.1

Digium Asterisk 1.2.21.1-netsec

1.2.21.1

Digium Asterisk 1.2.22

1.2.22

Digium Asterisk 1.2.22-netsec

1.2.22

Digium Asterisk 1.2.23

1.2.23

Digium Asterisk 1.2.23-netsec

1.2.23

Digium Asterisk 1.2.24

1.2.24

Digium Asterisk 1.2.24-netsec

1.2.24

Digium Asterisk 1.2.25

1.2.25

Digium Asterisk 1.2.25-netsec

1.2.25

Digium Asterisk 1.2.26

1.2.26

Digium Asterisk 1.2.26-netsec

1.2.26

Digium Asterisk 1.2.26.1

1.2.26.1

Digium Asterisk 1.2.26.1-netsec

1.2.26.1

Digium Asterisk 1.2.26.2

1.2.26.2

Digium Asterisk 1.2.26.2-netsec

1.2.26.2

Digium Asterisk 1.2.27

1.2.27

Digium Asterisk 1.2.28

1.2.28

Digium Asterisk 1.2.28.1

1.2.28.1

Digium Asterisk 1.2.29

1.2.29

Digium Asterisk 1.2.30

1.2.30

Digium Asterisk 1.2.30.1

1.2.30.1

Digium Asterisk 1.2.30.2

1.2.30.2

Digium Asterisk 1.2.30.3

1.2.30.3

Digium Asterisk 1.2.30.4

1.2.30.4

Digium Asterisk 1.2.31

1.2.31

Digium Asterisk 1.2.31.1

1.2.31.1

Digium Asterisk 1.2.32

1.2.32

Digium Asterisk 1.2.33

1.2.33

Digium Asterisk 1.2.34

1.2.34

Digium Asterisk 1.2.35

1.2.35

Digium Asterisk 1.2.36

1.2.36

Digium Asterisk 1.4.0

1.4.0

Digium Asterisk 1.4.1

1.4.1

Digium Asterisk 1.4.2

1.4.2

Digium Asterisk 1.4.3

1.4.3

Digium Asterisk 1.4.4

1.4.4

Digium Asterisk 1.4.5

1.4.5

Digium Asterisk 1.4.6

1.4.6

Digium Asterisk 1.4.7

1.4.7

Digium Asterisk 1.4.8

1.4.8

Digium Asterisk 1.4.9

1.4.9

Digium Asterisk 1.4.10

1.4.10

Digium Asterisk 1.4.11

1.4.11

Digium Asterisk 1.4.12

1.4.12

Digium Asterisk 1.4.13

1.4.13

Digium Asterisk 1.4.14

1.4.14

Digium Asterisk 1.4.15

1.4.15

Digium Asterisk 1.4.16

1.4.16

Digium Asterisk 1.4.17

1.4.17

Digium Asterisk 1.4.18

1.4.18

Digium Asterisk 1.4.19

1.4.19

Digium Asterisk 1.4.20

1.4.20

Digium Asterisk 1.4.21

1.4.21

Digium Asterisk 1.4.22

1.4.22

Digium Asterisk 1.4.23

1.4.23

Digium Asterisk 1.4.24

1.4.24

Digium Asterisk 1.4.25

1.4.25

Digium Asterisk 1.4.26

1.4.26

Digium Asterisk 1.4.27

1.4.27

Digium Asterisk 1.6.0

1.6.0

Digium Asterisk 1.6.1

1.6.1

Digium Asterisk 1.6.1.0

1.6.1.0

Digium Asterisk 1.6.2.0

1.6.2.0

Digium Asterisk Business Edition B.1.3.2

b.1.3.2

Digium Asterisk Business Edition B.1.3.3

b.1.3.3

Digium Asterisk Business Edition B.2.2.0

b.2.2.0

Digium Asterisk Business Edition B.2.2.1

b.2.2.1

Digium Asterisk Business Edition B.2.3.1

b.2.3.1

Digium Asterisk Business Edition B.2.3.2

b.2.3.2

Digium Asterisk Business Edition B.2.3.3

b.2.3.3

Digium Asterisk Business Edition B.2.3.4

b.2.3.4

Digium Asterisk Business Edition B.2.3.5

b.2.3.5

Digium Asterisk Business Edition B.2.3.6

b.2.3.6

Digium Asterisk Business Edition B.2.5.0

b.2.5.0

Digium Asterisk Business Edition B.2.5.1

b.2.5.1

Digium Asterisk Business Edition B2.5.2

b.2.5.2

Digium Asterisk Business Edition B.2.5.3

b.2.5.3

Digium Asterisk Business Edition C.1.0-beta7

c.1.0

Digium Asterisk Business Edition C.1.0-beta8

c.1.0

Digium Asterisk Business Edition C.1.6

c.1.6

Digium Asterisk Business Edition C.1.6.1

c.1.6.1

Digium Asterisk Business Edition C.1.6.2

c.1.6.2

Digium Asterisk Business Edition C.1.8.0

c.1.8.0

Digium Asterisk Business Edition C.1.8.1

c.1.8.1

Digium Asterisk Business Edition C.2.3

c.2.3

Digium Asterisk Business Edition C.3.0

c.3.0

References

http://downloads.digium.com/pub/security/AST-2010-002.html

Exploit, Vendor Advisory

FEDORA-2010-3724

38641

Vendor Advisory

39096

http://svn.asterisk.org/svn/asterisk/branches/1.2/README-SERIOUSLY.bestpractices.txt

20100218 AST-2010-002: Dialplan injection vulnerability

1023637

ADV-2010-0439

Vendor Advisory

asterisk-dial-weak-security(56397)

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.