4.3

CVE-2010-1224

main/acl.c in Asterisk Open Source 1.6.0.x before 1.6.0.25, 1.6.1.x before 1.6.1.17, and 1.6.2.x before 1.6.2.5 does not properly enforce remote host access controls when CIDR notation "/0" is used in permit= and deny= configuration rules, which causes an improper arithmetic shift and might allow remote attackers to bypass ACL rules and access services from unauthorized hosts.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Digium ≫ Asterisk Version1.6.0
Digium ≫ Asterisk Version1.6.0.1
Digium ≫ Asterisk Version1.6.0.2
Digium ≫ Asterisk Version1.6.0.3
Digium ≫ Asterisk Version1.6.0.5
Digium ≫ Asterisk Version1.6.0.6
Digium ≫ Asterisk Version1.6.0.7
Digium ≫ Asterisk Version1.6.0.8
Digium ≫ Asterisk Version1.6.0.9
Digium ≫ Asterisk Version1.6.0.10
Digium ≫ Asterisk Version1.6.0.12
Digium ≫ Asterisk Version1.6.0.13
Digium ≫ Asterisk Version1.6.0.14
Digium ≫ Asterisk Version1.6.0.15
Digium ≫ Asterisk Version1.6.0.16 Updaterc1
Digium ≫ Asterisk Version1.6.0.16 Updaterc2
Digium ≫ Asterisk Version1.6.0.17
Digium ≫ Asterisk Version1.6.0.18
Digium ≫ Asterisk Version1.6.0.18 Updaterc1
Digium ≫ Asterisk Version1.6.0.18 Updaterc2
Digium ≫ Asterisk Version1.6.0.18 Updaterc3
Digium ≫ Asterisk Version1.6.0.19
Digium ≫ Asterisk Version1.6.0.20 Updaterc1
Digium ≫ Asterisk Version1.6.0.21
Digium ≫ Asterisk Version1.6.0.21 Updaterc1
Digium ≫ Asterisk Version1.6.0.22
Digium ≫ Asterisk Version1.6.0.23 Updaterc2
Digium ≫ Asterisk Version1.6.0.24
Digium ≫ Asterisk Version1.6.1
Digium ≫ Asterisk Version1.6.1.1
Digium ≫ Asterisk Version1.6.1.2
Digium ≫ Asterisk Version1.6.1.4
Digium ≫ Asterisk Version1.6.1.5
Digium ≫ Asterisk Version1.6.1.6
Digium ≫ Asterisk Version1.6.1.7 Updaterc1
Digium ≫ Asterisk Version1.6.1.7 Updaterc2
Digium ≫ Asterisk Version1.6.1.8
Digium ≫ Asterisk Version1.6.1.9
Digium ≫ Asterisk Version1.6.1.10
Digium ≫ Asterisk Version1.6.1.10 Updaterc1
Digium ≫ Asterisk Version1.6.1.10 Updaterc2
Digium ≫ Asterisk Version1.6.1.10 Updaterc3
Digium ≫ Asterisk Version1.6.1.11
Digium ≫ Asterisk Version1.6.1.12
Digium ≫ Asterisk Version1.6.1.12 Updaterc1
Digium ≫ Asterisk Version1.6.1.13
Digium ≫ Asterisk Version1.6.1.13 Updaterc1
Digium ≫ Asterisk Version1.6.1.14
Digium ≫ Asterisk Version1.6.1.15 Updaterc2
Digium ≫ Asterisk Version1.6.1.16
Digium ≫ Asterisk Version1.6.2.0
Digium ≫ Asterisk Version1.6.2.0 Updaterc2
Digium ≫ Asterisk Version1.6.2.0 Updaterc3
Digium ≫ Asterisk Version1.6.2.0 Updaterc4
Digium ≫ Asterisk Version1.6.2.0 Updaterc5
Digium ≫ Asterisk Version1.6.2.0 Updaterc6
Digium ≫ Asterisk Version1.6.2.0 Updaterc7
Digium ≫ Asterisk Version1.6.2.0 Updaterc8
Digium ≫ Asterisk Version1.6.2.1
Digium ≫ Asterisk Version1.6.2.1 Updaterc1
Digium ≫ Asterisk Version1.6.2.2
Digium ≫ Asterisk Version1.6.2.3 Updaterc2
Digium ≫ Asterisk Version1.6.2.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.55% 0.878
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037679.html
http://secunia.com/advisories/39096
http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff
http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff
http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.2.diff
Patch
http://downloads.asterisk.org/pub/security/AST-2010-003.html
http://osvdb.org/62588
http://secunia.com/advisories/38752
Vendor Advisory
http://www.securityfocus.com/archive/1/509757/100/0/threaded
http://www.securityfocus.com/bid/38424
http://www.vupen.com/english/advisories/2010/0475
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/56552