Multiple vulnerabilities have been discovered in Asterisk, the worst of which can lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 18.26.3 | >= 18.26.3 |
Asterisk is an open source telephony engine and toolkit.
Multiple vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-18.26.3"
Multiple vulnerabilities have been discovered in Asterisk, the worst of which can lead to privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 18.24.3 | >= 18.24.3 |
Asterisk is an open source telephony engine and toolkit.
Multiple vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-18.24.3"
Multiple vulnerabilities have been found in Asterisk, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 13.38.1 | >= 13.38.1 |
A Modular Open Source PBX System.
Multiple vulnerabilities have been discovered in Asterisk. Please review the security advisories referenced below for details.
An attacker could cause a possible Denial of Service condition.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-13.38.1"
A vulnerability was discovered in Asterisk which may allow local attackers to gain root privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 13.32.0-r1 | >= 13.32.0-r1 |
A Modular Open Source PBX System.
It was discovered that Gentoo’s Asterisk ebuild does not properly set permissions on its data directories. This only affects OpenRC systems, as the flaw was exploitable via the init script.
A local attacker could escalate privileges.
Users should ensure the proper permissions are set as discussed in the referenced bugs. Do not run /etc/init.d/asterisk checkperms.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-13.32.0-r1"
Multiple vulnerabilities have been found in Asterisk, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 13.23.1 | >= 13.23.1 |
A Modular Open Source PBX System.
Multiple vulnerabilities have been discovered in Asterisk. Please review the referenced CVE identifiers for details.
A remote attacker could cause a Denial of Service condition or conduct information gathering.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-13.23.1"
Multiple vulnerabilities have been found in Asterisk, the worst of which allows remote execution of arbitrary shell commands.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 11.25.3 | >= 11.25.3 |
A Modular Open Source PBX System.
Multiple vulnerabilities have been discovered in Asterisk. Please review the referenced CVE identifiers for details.
A remote attacker could execute arbitrary code, cause a denial of service condition, or cause an unauthorized data disclosure by enticing a user to run malicious code.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-13.17.2"
Multiple vulnerabilities have been found in Asterisk, the worst of which could lead to Denial of Service, bypass intended ACL restrictions or allow an authenticated user to gain escalated privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 11.14.2 | >= 11.14.2 |
Asterisk is an open source telephony engine and toolkit.
Multiple unspecified vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers referenced below for details.
Unauthenticated remote attackers can cause Denial of Service or bypass intended ACL restrictions. Authenticated remote attackers can gain escalated privileges.
There is no known workaround at this time.
All asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-11.14.2"
Multiple vulnerabilities have been found in Asterisk, the worst of which could lead to Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 11.13.1 | >= 11.13.1 |
Asterisk is an open source telephony engine and toolkit.
Multiple unspecified vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers referenced below for details.
A remote attacker could exploit the vulnerabilities to cause a man in the middle attack or cause a Denial of Service condition.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-11.13.1"
Multiple vulnerabilities have been discovered in Asterisk, the worst of which could allow privileged users to execute arbitrary system shell commands.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 11.10.2 | >= 11.10.2, >= 1.8.28.2 (revision) |
Asterisk is an open source telephony engine and toolkit.
Multiple vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers below for details.
A remote attacker that gains access to a privileged Asterisk account can execute arbitrary system shell commands. Furthermore an unprivileged remote attacker could cause a Denial of Service condition.
There is no known workaround at this time.
All Asterisk 11 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-11.10.2"
All Asterisk 1.8 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.8.28.2"
Multiple buffer overflows in Asterisk might allow remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 11.8.1 | >= 11.8.1, >= 1.8.26.1 (revision) |
Asterisk is an open source telephony engine and toolkit.
Multiple vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers and Asterisk Project Security Advisories referenced below for details.
A remote attacker could possibly cause a Denial of Service condition.
There is no known workaround at this time.
All Asterisk 11.* users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-11.8.1"
All Asterisk 1.8.* users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.8.26.1"
Multiple vulnerabilities have been found in Asterisk, the worst of which may allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 11.7.0 | >= 11.7.0, >= 1.8.25.0 (revision) |
Asterisk is an open source telephony engine and toolkit.
Multiple vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers referenced below for details.
A remote attacker could execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or obtain sensitive information.
There is no known workaround at this time.
All Asterisk 11.* users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-11.7.0"
All Asterisk 1.8.* users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.8.25.0"
Multiple vulnerabilities have been found in Asterisk, the worst of which may allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 1.8.15.1 | >= 1.8.15.1 |
Asterisk is an open source telephony engine and toolkit.
Multiple vulnerabilities have been found in Asterisk:
A remote, authenticated attacker could execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or bypass outbound call restrictions.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.8.15.1"
Multiple vulnerabilities in Asterisk might allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 1.8.12.1 | >= 1.8.12.1 |
Asterisk is an open source telephony engine and toolkit.
Multiple vulnerabilities have been found in Asterisk:
A remote attacker could execute arbitrary code with the privileges of the process or cause a Denial of Service condition.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.8.12.1"
Multiple vulnerabilities have been found in Asterisk, the worst of which may allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 1.8.10.1 | >= 1.8.10.1 |
Asterisk is an open source telephony engine and toolkit.
Two vulnerabilities have been found in Asterisk:
A remote unauthenticated attacker could execute arbitrary code or cause a Denial of Service condition.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.8.10.1"
A vulnerability in Asterisk could allow a remote attacker to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 1.8.8.2 | >= 1.8.8.2 |
Asterisk is an open source telephony engine and toolkit.
A vulnerability has been found in Asterisk's handling of certain encrypted streams where the res_srtp module has been loaded but video support has not been enabled.
A remote attacker could send a specially crafted SDP message to the Asterisk daemon, possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.8.8.2"
Multiple vulnerabilities in Asterisk might allow unauthenticated remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 1.8.7.1 | >= 1.8.7.1, >= 1.6.2.18.2 (revision) |
Asterisk is an open source telephony engine and toolkit.
Multiple vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers referenced below for details.
An unauthenticated remote attacker may execute code with the privileges of the Asterisk process or cause a Denial of Service.
There is no known workaround at this time.
All asterisk 1.6.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.6.2.18.2"
All asterisk 1.8.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.8.7.1"
Multiple vulnerabilities in Asterisk might allow remote attackers to cause a Denial of Service condition, or conduct other attacks.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 1.2.37 | >= 1.2.37 |
Asterisk is an open source telephony engine and toolkit.
Multiple vulnerabilities have been reported in Asterisk:
A remote attacker could exploit these vulnerabilities by sending a specially crafted package, possibly causing a Denial of Service condition, or resulting in information disclosure.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.2.37"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since January 5, 2010. It is likely that your system is already no longer affected by this issue.
Multiple vulnerabilities have been found in Asterisk allowing for Denial of Service and username disclosure.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 1.2.32 | >= 1.2.32 |
Asterisk is an open source telephony engine and toolkit.
Multiple vulnerabilities have been discovered in the IAX2 channel driver when performing the 3-way handshake (CVE-2008-1897), when handling a large number of POKE requests (CVE-2008-3263), when handling authentication attempts (CVE-2008-5558) and when handling firmware download (FWDOWNL) requests (CVE-2008-3264). Asterisk does also not correctly handle SIP INVITE messages that lack a "From" header (CVE-2008-2119), and responds differently to a failed login attempt depending on whether the user account exists (CVE-2008-3903, CVE-2009-0041).
Remote unauthenticated attackers could send specially crafted data to Asterisk, possibly resulting in a Denial of Service via a daemon crash, call-number exhaustion, CPU or traffic consumption. Remote unauthenticated attackers could furthermore enumerate valid usernames to facilitate brute force login attempts.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.2.32"
Multiple vulnerabilities have been found in Asterisk allowing for SQL injection, session hijacking and unauthorized usage.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 1.2.27 | >= 1.2.27 |
Asterisk is an open source telephony engine and tool kit.
Asterisk upstream developers reported multiple vulnerabilities:
Remote authenticated attackers could send specially crafted data to Asterisk to execute arbitrary SQL commands and compromise the administrative database. Remote unauthenticated attackers could bypass authentication using a valid username to hijack other user's sessions, and establish sessions on the SIP channel without authentication.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.2.27"
Multiple vulnerabilities have been found in Asterisk.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 1.2.21.1-r1 | >= 1.2.17-r1 (revision), >= 1.2.21.1-r1 |
Asterisk is an open source telephony engine and tool kit.
Multiple vulnerabilities have been found in Asterisk:
By sending a long voice or video RTP frame, a remote attacker could possibly execute arbitrary code on the target machine. Sending specially crafted LAGRQ or LAGRP frames containing information elements of IAX frames, or a certain data length value in a crafted packet, or performing a flood of calls not completing a 3-way handshake, could result in a Denial of Service.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.2.17-r1"
Asterisk is vulnerable to two Denial of Service issues in the SIP channel.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 1.2.14-r2 | >= 1.2.14-r2, >= 1.0.12-r2 (revision) |
Asterisk is an open source implementation of a telephone private branch exchange (PBX).
The Madynes research team at INRIA has discovered that Asterisk contains a null pointer dereferencing error in the SIP channel when handling INVITE messages. Furthermore qwerty1979 discovered that Asterisk 1.2.x fails to properly handle SIP responses with return code 0.
A remote attacker could cause an Asterisk server listening for SIP messages to crash by sending a specially crafted SIP message or answering with a 0 return code.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose net-misc/asterisk
Note: Asterisk 1.0.x is no longer supported upstream so users should consider upgrading to Asterisk 1.2.x.
Asterisk is vulnerable to Denial of Service in the SIP channel.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 1.2.14-r1 | >= 1.2.14-r1, >= 1.0.12-r1 (revision) |
Asterisk is an open source implementation of a telephone private branch exchange (PBX).
The MU Security Research Team discovered that Asterisk contains a NULL-pointer dereferencing error in the SIP channel when handling request messages.
A remote attacker could cause an Asterisk server listening for SIP messages to crash by sending a specially crafted SIP request message.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose net-misc/asterisk
Note: Asterisk 1.0.x is no longer supported upstream so users should consider upgrading to Asterisk 1.2.x.
Asterisk is vulnerable to the remote execution of arbitrary code or a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 1.2.13, < 1.0.12 | >= 1.2.13, >= 1.0.12 (revision) |
Asterisk is an open source implementation of a telephone private branch exchange (PBX).
Asterisk contains buffer overflows in channels/chan_mgcp.c from the MGCP driver and in channels/chan_skinny.c from the Skinny channel driver for Cisco SCCP phones. It also dangerously handles client-controlled variables to determine filenames in the Record() function. Finally, the SIP channel driver in channels/chan_sip.c could use more resources than necessary under unspecified circumstances.
A remote attacker could execute arbitrary code by sending a crafted audit endpoint (AUEP) response, by sending an overly large Skinny packet even before authentication, or by making use of format strings specifiers through the client-controlled variables. An attacker could also cause a Denial of Service by resource consumption through the SIP channel driver.
There is no known workaround for the format strings vulnerability at this time. You can comment the lines in /etc/asterisk/mgcp.conf, /etc/asterisk/skinny.conf and /etc/asterisk/sip.conf to deactivate the three vulnerable channel drivers. Please note that the MGCP channel driver is disabled by default.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.2.13"
Asterisk contains a bug in the IAX2 channel driver making it vulnerable to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/asterisk | * | < 1.0.11_p1 | >= 1.0.11_p1 |
Asterisk is an open source implementation of a telephone private branch exchange (PBX).
Asterisk fails to properly check the length of truncated video frames in the IAX2 channel driver which results in a buffer overflow.
An attacker could exploit this vulnerability by sending a specially crafted IAX2 video stream resulting in the execution of arbitrary code with the permissions of the user running Asterisk.
Disable public IAX2 support.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.0.11_p1"