4.3

CVE-2010-1224

main/acl.c in Asterisk Open Source 1.6.0.x before 1.6.0.25, 1.6.1.x before 1.6.1.17, and 1.6.2.x before 1.6.2.5 does not properly enforce remote host access controls when CIDR notation "/0" is used in permit= and deny= configuration rules, which causes an improper arithmetic shift and might allow remote attackers to bypass ACL rules and access services from unauthorized hosts.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Digium ≫ Asterisk Version 1.6.0
Digium ≫ Asterisk Version 1.6.0.1
Digium ≫ Asterisk Version 1.6.0.2
Digium ≫ Asterisk Version 1.6.0.3
Digium ≫ Asterisk Version 1.6.0.5
Digium ≫ Asterisk Version 1.6.0.6
Digium ≫ Asterisk Version 1.6.0.7
Digium ≫ Asterisk Version 1.6.0.8
Digium ≫ Asterisk Version 1.6.0.9
Digium ≫ Asterisk Version 1.6.0.10
Digium ≫ Asterisk Version 1.6.0.12
Digium ≫ Asterisk Version 1.6.0.13
Digium ≫ Asterisk Version 1.6.0.14
Digium ≫ Asterisk Version 1.6.0.15
Digium ≫ Asterisk Version 1.6.0.16 Update rc1
Digium ≫ Asterisk Version 1.6.0.16 Update rc2
Digium ≫ Asterisk Version 1.6.0.17
Digium ≫ Asterisk Version 1.6.0.18
Digium ≫ Asterisk Version 1.6.0.18 Update rc1
Digium ≫ Asterisk Version 1.6.0.18 Update rc2
Digium ≫ Asterisk Version 1.6.0.18 Update rc3
Digium ≫ Asterisk Version 1.6.0.19
Digium ≫ Asterisk Version 1.6.0.20 Update rc1
Digium ≫ Asterisk Version 1.6.0.21
Digium ≫ Asterisk Version 1.6.0.21 Update rc1
Digium ≫ Asterisk Version 1.6.0.22
Digium ≫ Asterisk Version 1.6.0.23 Update rc2
Digium ≫ Asterisk Version 1.6.0.24
Digium ≫ Asterisk Version 1.6.1
Digium ≫ Asterisk Version 1.6.1.1
Digium ≫ Asterisk Version 1.6.1.2
Digium ≫ Asterisk Version 1.6.1.4
Digium ≫ Asterisk Version 1.6.1.5
Digium ≫ Asterisk Version 1.6.1.6
Digium ≫ Asterisk Version 1.6.1.7 Update rc1
Digium ≫ Asterisk Version 1.6.1.7 Update rc2
Digium ≫ Asterisk Version 1.6.1.8
Digium ≫ Asterisk Version 1.6.1.9
Digium ≫ Asterisk Version 1.6.1.10
Digium ≫ Asterisk Version 1.6.1.10 Update rc1
Digium ≫ Asterisk Version 1.6.1.10 Update rc2
Digium ≫ Asterisk Version 1.6.1.10 Update rc3
Digium ≫ Asterisk Version 1.6.1.11
Digium ≫ Asterisk Version 1.6.1.12
Digium ≫ Asterisk Version 1.6.1.12 Update rc1
Digium ≫ Asterisk Version 1.6.1.13
Digium ≫ Asterisk Version 1.6.1.13 Update rc1
Digium ≫ Asterisk Version 1.6.1.14
Digium ≫ Asterisk Version 1.6.1.15 Update rc2
Digium ≫ Asterisk Version 1.6.1.16
Digium ≫ Asterisk Version 1.6.2.0
Digium ≫ Asterisk Version 1.6.2.0 Update rc2
Digium ≫ Asterisk Version 1.6.2.0 Update rc3
Digium ≫ Asterisk Version 1.6.2.0 Update rc4
Digium ≫ Asterisk Version 1.6.2.0 Update rc5
Digium ≫ Asterisk Version 1.6.2.0 Update rc6
Digium ≫ Asterisk Version 1.6.2.0 Update rc7
Digium ≫ Asterisk Version 1.6.2.0 Update rc8
Digium ≫ Asterisk Version 1.6.2.1
Digium ≫ Asterisk Version 1.6.2.1 Update rc1
Digium ≫ Asterisk Version 1.6.2.2
Digium ≫ Asterisk Version 1.6.2.3 Update rc2
Digium ≫ Asterisk Version 1.6.2.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.55% 0.878
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037679.html
http://secunia.com/advisories/39096
http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff
http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff
http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.2.diff
Patch
http://downloads.asterisk.org/pub/security/AST-2010-003.html
http://osvdb.org/62588
http://secunia.com/advisories/38752
Vendor Advisory
http://www.securityfocus.com/archive/1/509757/100/0/threaded
http://www.securityfocus.com/bid/38424
http://www.vupen.com/english/advisories/2010/0475
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/56552