CVE-2012-2414
Last modified
CVE-2012-2414 is a vulnerability of currently unknown severity. main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements, which allows remote authenticated users to execute arbitrary commands via (1) the originate action in the MixMonitor application, (2) the SHELL and EVAL functions in the GetVar manager action, or (3) the SHELL and EVAL functions in the Status manager action.. EPSS estimates a 2.72% chance of exploitation in the next 30 days.
Description
main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements, which allows remote authenticated users to execute arbitrary commands via (1) the originate action in the MixMonitor application, (2) the SHELL and EVAL functions in the GetVar manager action, or (3) the SHELL and EVAL functions in the Status manager action.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Asterisk | Open Source | 1.6.2.0 | — |
| Asterisk | Open Source | 1.6.2.1 | — |
| Asterisk | Open Source | 1.6.2.2 | — |
| Asterisk | Open Source | 1.6.2.3 | Rc2 |
| Asterisk | Open Source | 1.6.2.4 | — |
| Asterisk | Open Source | 1.6.2.5 | — |
| Asterisk | Open Source | 1.6.2.6 | — |
| Asterisk | Open Source | 1.6.2.7 | — |
| Asterisk | Open Source | 1.6.2.8 | — |
| Asterisk | Open Source | 1.6.2.9 | — |
| Asterisk | Open Source | 1.6.2.10 | — |
| Asterisk | Open Source | 1.6.2.11 | — |
| Asterisk | Open Source | 1.6.2.12 | — |
| Asterisk | Open Source | 1.6.2.13 | — |
| Asterisk | Open Source | 1.6.2.14 | — |
| Asterisk | Open Source | 1.6.2.15 | — |
| Asterisk | Open Source | 1.6.2.15.1 | — |
| Asterisk | Open Source | 1.6.2.16 | — |
| Asterisk | Open Source | 1.6.2.16.1 | — |
| Asterisk | Open Source | 1.6.2.16.2 | — |
| Asterisk | Open Source | 1.6.2.17 | — |
| Asterisk | Open Source | 1.6.2.17.1 | — |
| Asterisk | Open Source | 1.6.2.17.2 | — |
| Asterisk | Open Source | 1.6.2.17.3 | — |
| Asterisk | Open Source | 1.6.2.18 | — |
| Asterisk | Open Source | 1.6.2.18.1 | — |
| Asterisk | Open Source | 1.6.2.18.2 | — |
| Asterisk | Open Source | 1.6.2.19 | — |
| Asterisk | Open Source | 1.6.2.20 | — |
| Asterisk | Open Source | 1.6.2.21 | — |
| Asterisk | Open Source | 1.6.2.22 | — |
| Asterisk | Open Source | 1.6.2.23 | — |
| Asterisk | Open Source | 1.8.0 | — |
| Asterisk | Open Source | 1.8.1 | — |
| Asterisk | Open Source | 1.8.1.1 | — |
| Asterisk | Open Source | 1.8.1.2 | — |
| Asterisk | Open Source | 1.8.2 | — |
| Asterisk | Open Source | 1.8.2.1 | — |
| Asterisk | Open Source | 1.8.2.2 | — |
| Asterisk | Open Source | 1.8.2.3 | — |
| Asterisk | Open Source | 1.8.2.4 | — |
| Asterisk | Open Source | 1.8.3 | — |
| Asterisk | Open Source | 1.8.3.1 | — |
| Asterisk | Open Source | 1.8.3.2 | — |
| Asterisk | Open Source | 1.8.3.3 | — |
| Asterisk | Open Source | 1.8.4 | — |
| Asterisk | Open Source | 1.8.4.1 | — |
| Asterisk | Open Source | 1.8.4.2 | — |
| Asterisk | Open Source | 1.8.4.3 | — |
| Asterisk | Open Source | 1.8.4.4 | — |
Showing 50 of 75 affected configurations. See NVD for the full list.
References
- http://downloads.asterisk.org/pub/security/AST-2012-004.htmlPatch, Vendor Advisory
- http://downloads.asterisk.org/pub/security/AST-2012-004.htmlPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2012-2414?
How severe is CVE-2012-2414?
How do I fix CVE-2012-2414?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2012
- CVE-2012-2408The AAC SDK in RealNetworks RealPlayer before 15.0.6.14, Rea…
- CVE-2012-2409Buffer overflow in RealNetworks RealPlayer before 15.0.6.14,…
- CVE-2012-2410Buffer overflow in RealNetworks RealPlayer before 15.0.6.14,…
- CVE-2012-2411Buffer overflow in RealNetworks RealPlayer before 15.0.4.53,…
- CVE-2012-2412Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2012-2413Cross-site scripting (XSS) vulnerability in the ja_purity te…
- CVE-2012-2415Heap-based buffer overflow in chan_skinny.c in the Skinny ch…
- CVE-2012-2416chan_sip.c in the SIP channel driver in Asterisk Open Source…
- CVE-2012-2417PyCrypto before 2.6 does not produce appropriate prime numbe…
- CVE-2012-2418Heap-based buffer overflow in the intu-help-qb (aka Intuit H…
- CVE-2012-2419Memory leak in the intu-help-qb (aka Intuit Help System Asyn…
- CVE-2012-2420The intu-help-qb (aka Intuit Help System Async Pluggable Pro…
Are you affected by CVE-2012-2414?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST