2017-09-02 18:29:00 2019-10-03 02:03:26

In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command execution is possible. The app_minivm module has an "externnotify" program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source, a crafted caller-id name or number allows an arbitrary shell command injection.

Vector

NETWORK

Complexity

LOW

Authentication

NONE

Confidentiality

PARTIAL

Integrity

PARTIAL

Availability

PARTIAL
Digium Certified asterisk 11.6 Cert9 (not an official CPE) Digium Certified asterisk 11.6 Cert8 (not an official CPE) Digium Certified asterisk 11.6 Cert7 (not an official CPE) Digium Certified asterisk 11.6 Cert6 (not an official CPE) Digium Certified asterisk 11.6 Cert5 (not an official CPE) Digium Certified asterisk 11.6 Cert4 (not an official CPE) Digium Certified Asterisk 11.6-cert3 Digium Certified Asterisk 11.6-cert2 Digium Certified Asterisk 11.6-cert1 release candidate 2 Digium Certified Asterisk 11.6-cert1 release candidate 1 Digium Certified asterisk 11.6 Cert16 (not an official CPE) Digium Certified asterisk 11.6 Cert15 (not an official CPE) Digium Certified asterisk 11.6 Cert14 rc2 (not an official CPE) Digium Certified asterisk 11.6 Cert14 rc1 (not an official CPE) Digium Certified asterisk 11.6 Cert14 (not an official CPE) Digium Certified asterisk 11.6 Cert13 (not an official CPE) Digium Certified asterisk 11.6 Cert12 (not an official CPE) Digium Certified asterisk 11.6 Cert11 (not an official CPE) Digium Certified asterisk 11.6 Cert10 (not an official CPE) Digium Certified Asterisk 11.6-cert1 Digium Asterisk 14.6.0 Rc1 (not an official CPE) Digium Asterisk 14.6.0 (not an official CPE) Digium Asterisk 14.5.0 Rc2 (not an official CPE) Digium Asterisk 14.5.0 Rc1 (not an official CPE) Digium Asterisk 14.5.0 (not an official CPE) Digium Asterisk 14.4.1 (not an official CPE) Digium Asterisk 14.4.0 Rc3 (not an official CPE) Digium Asterisk 14.4.0 Rc2 (not an official CPE) Digium Asterisk 14.4.0 Rc1 (not an official CPE) Digium Asterisk 14.3.1 (not an official CPE) Digium Asterisk 14.4.0 (not an official CPE) Digium Asterisk 14.3.0 Rc2 (not an official CPE) Digium Asterisk 14.3.0 Rc1 (not an official CPE) Digium Asterisk 14.3.0 (not an official CPE) Digium Asterisk 14.2.1 (not an official CPE) Digium Asterisk 14.2.0 (not an official CPE) Digium Asterisk 14.2 (not an official CPE) Digium Asterisk 14.1.2 (not an official CPE) Digium Asterisk 14.1.1 (not an official CPE) Digium Asterisk 14.1.0 (not an official CPE) Digium Asterisk 14.01 (not an official CPE) Digium Asterisk 14.0.2 (not an official CPE) Digium Asterisk 14.0.1 (not an official CPE) Digium Asterisk 14.0.0 Rc2 (not an official CPE) Digium Asterisk 14.0.0 Rc1 (not an official CPE) Digium Asterisk 14.0.0 Beta2 (not an official CPE) Digium Asterisk 14.0.0 Beta1 (not an official CPE) Digium Asterisk 14.0 (not an official CPE) Digium Asterisk 14.0.0 (not an official CPE) Digium Asterisk 13.17.0 Rc1 (not an official CPE) Digium Asterisk 13.17.0 (not an official CPE) Digium Asterisk 13.16.0 Rc2 (not an official CPE) Digium Asterisk 13.16.0 Rc1 (not an official CPE) Digium Asterisk 13.16.0 (not an official CPE) Digium Asterisk 13.15.1 (not an official CPE) Digium Asterisk 13.15.0 Rc3 (not an official CPE) Digium Asterisk 13.15.0 Rc2 (not an official CPE) Digium Asterisk 13.15.0 Rc1 (not an official CPE) Digium Asterisk 13.15.0 (not an official CPE) Digium Asterisk 13.14.1 (not an official CPE) Digium Asterisk 13.14.0 Rc2 (not an official CPE) Digium Asterisk 13.14.0 Rc1 (not an official CPE) Digium Asterisk 13.14.0 (not an official CPE) Digium Asterisk 13.13.1 (not an official CPE) Digium Asterisk 13.13.0 (not an official CPE) Digium Asterisk 13.13 (not an official CPE) Digium Asterisk 13.12.2 (not an official CPE) Digium Asterisk 13.12.1 (not an official CPE) Digium Asterisk 13.12.0 (not an official CPE) Digium Asterisk 13.12 (not an official CPE) Digium Asterisk 13.11.2 (not an official CPE) Digium Asterisk 13.11.1 (not an official CPE) Digium Asterisk 13.11.0 (not an official CPE) Digium Asterisk 13.10.0 Rc1 (not an official CPE) Digium Asterisk 13.10.0 (not an official CPE) Digium Asterisk 13.9.1 (not an official CPE) Digium Asterisk 13.9.0 (not an official CPE) Digium Asterisk 13.8.2 (not an official CPE) Digium Asterisk 13.8.1 (not an official CPE) Digium Asterisk 13.8.0 (not an official CPE) Digium Asterisk 13.8.0 Rc1 (not an official CPE) Digium Asterisk 13.7.2 (not an official CPE) Digium Asterisk 13.7.1 (not an official CPE) Digium Asterisk 13.7.0 Rc1 (not an official CPE) Digium Asterisk 13.7.0 Rc2 (not an official CPE) Digium Asterisk 13.6.0 Rc1 (not an official CPE) Digium Asterisk 13.5.0 (not an official CPE) Digium Asterisk 13.5.0 Rc1 (not an official CPE) Digium Asterisk 13.4.0 Rc1 (not an official CPE) Digium Asterisk 13.3.2 (not an official CPE) Digium Asterisk 13.4.0 (not an official CPE) Digium Asterisk 13.3.0 Rc1 (not an official CPE) Digium Asterisk 13.2.1 (not an official CPE) Digium Asterisk 13.2.0 release candidate 1 Digium Asterisk 13.2.0 Digium Asterisk 13.1.1 (not an official CPE) Digium Asterisk 13.1.0 release candidate 2 Digium Asterisk 13.1.0 release candidate 1 Digium Asterisk 13.1.0 Digium Asterisk 13.0.2 (not an official CPE) Digium Asterisk 13.0.1 Digium Asterisk 13.0.0 Beta3 (not an official CPE) Digium Asterisk 13.0.0 Beta2 (not an official CPE) Digium Asterisk 13.0.0 Beta1 (not an official CPE) Digium Asterisk 13.0.0 LTS Digium Asterisk 11.25.1 (not an official CPE) Digium Asterisk 11.25.0 (not an official CPE) Digium Asterisk 11.24.1 (not an official CPE) Digium Asterisk 11.23.1 (not an official CPE) Digium Asterisk 11.24.0 (not an official CPE) Digium Asterisk 11.23.0 Rc1 (not an official CPE) Digium Asterisk 11.23.0 (not an official CPE) Digium Asterisk 11.22.0 Rc1 (not an official CPE) Digium Asterisk 11.22.0 (not an official CPE) Digium Asterisk 11.21.2 (not an official CPE) Digium Asterisk 11.21.0 Rc2 (not an official CPE) Digium Asterisk 11.21.1 (not an official CPE) Digium Asterisk 11.21.0 Rc1 (not an official CPE) Digium Asterisk 11.20.0 Rc1 (not an official CPE) Digium Asterisk 11.19.0 Rc1 (not an official CPE) Digium Asterisk 11.18.0 Rc1 (not an official CPE) Digium Asterisk 11.18.0 (not an official CPE) Digium Asterisk 11.17.1 (not an official CPE) Digium Asterisk 11.17.0 Rc1 (not an official CPE) Digium Asterisk 11.16.0 Rc1 (not an official CPE) Digium Asterisk 11.15.1 (not an official CPE) Digium Asterisk 11.15.0 Rc2 (not an official CPE) Digium Asterisk 11.15.0 Rc1 (not an official CPE) Digium Asterisk 11.14.2 (not an official CPE) Digium Asterisk 11.14.1 (not an official CPE) Digium Asterisk 11.14.0 release candidate 2 Digium Asterisk 11.14.0 release candidate 1 Digium Asterisk 11.14.0 LTS Digium Asterisk 11.13.1 (not an official CPE) Digium Asterisk 11.13.0 release candidate 1 Digium Asterisk 11.13.0 Digium Asterisk 11.12.1 (not an official CPE) Digium Asterisk 11.12.0 release candidate 1 Digium Asterisk 11.12.0 Digium Asterisk 11.11.0 release candidate 1 Digium Asterisk 11.11.0 Digium Asterisk 11.10.2 (not an official CPE) Digium Asterisk 11.10.1 release candidate 1 Digium Asterisk 11.10.1 Digium Asterisk 11.10.0 release candidate 1 Digium Asterisk 11.10.0 Digium Asterisk 11.9.0 release candidate 3 Digium Asterisk 11.9.0 release candidate 2 Digium Asterisk 11.9.0 release candidate 1 Digium Asterisk 11.9.0 Digium Asterisk 11.8.1 Digium Asterisk 11.8.0 release candidate 3 Digium Asterisk 11.8.0 release candidate 2 Digium Asterisk 11.8.0 release candidate 1 Digium Asterisk 11.8.0 Digium Asterisk 11.7.0 release candidate 2 Digium Asterisk 11.7.0 release candidate 1 Digium Asterisk 11.7.0 Digium Asterisk 11.6.1 (not an official CPE) Digium Asterisk 11.6.0 release candidate 2 Digium Asterisk 11.6.0 release candidate 1 Digium Asterisk 11.6.0 Digium Asterisk 11.4.0 release candidate 4 Digium Asterisk 11.2.2 (not an official CPE) Digium Asterisk 11.2.1 (not an official CPE) Digium Asterisk 11.2.0 release candidate 1 Digium Asterisk 11.1.2 Digium Asterisk 11.1.1 Digium Asterisk 11.1.0 release candidate 3 Digium Asterisk 11.1.0 release candidate 2 Digium Asterisk 11.1.0 release candidate 1 Digium Asterisk 11.1.0 Digium Asterisk 11.0.2 Digium Asterisk 11.0.1 Digium Asterisk 11.0.0 release candidate 2 Digium Asterisk 11.0.0 release candidate 1 Digium Asterisk 11.0.0 beta2 Digium Asterisk 11.0.0 beta1 Digium Asterisk 11.0.0 Digium Certified asterisk 13.13 Cert1 (not an official CPE) Digium Certified asterisk 13.13 Cert1 rc1 (not an official CPE) Digium Certified asterisk 13.13 Cert1 rc2 (not an official CPE) Digium Certified asterisk 13.13 Cert1 rc3 (not an official CPE) Digium Certified asterisk 13.13 Cert1 rc4 (not an official CPE) Digium Certified asterisk 13.13 Cert2 (not an official CPE) Digium Certified asterisk 13.13 Cert3 (not an official CPE) Digium Certified asterisk 13.13 Cert4 (not an official CPE)