Homepage

OS Command Injection Affecting asterisk package, versions <1:13.17.1~dfsg-1

Severity

 Recommended
0.0
critical
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
14.91% (97th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-ASTERISK-428993
  • published2 Sept 2017
  • disclosed2 Sept 2017
Report a new vulnerability Found a mistake?

Introduced: 2 Sep 2017

CVE-2017-14100  (opens in a new tab)
CWE-78  (opens in a new tab)

How to fix?

Upgrade Debian:unstable asterisk to version 1:13.17.1~dfsg-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream asterisk package and not the asterisk package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command execution is possible. The app_minivm module has an "externnotify" program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source, a crafted caller-id name or number allows an arbitrary shell command injection.