CVE-2014-8412

NameCVE-2014-8412
DescriptionThe (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 allows remote attackers to bypass the ACL restrictions via a packet with a source IP that does not share the address family as the first ACL entry.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-455-1
NVD severitymedium (attack range: remote)
Debian Bugs771463

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
asterisk (PTS)jessie1:11.13.1~dfsg-2+deb8u5fixed
jessie (security)1:11.13.1~dfsg-2+deb8u6fixed
stretch (security), stretch1:13.14.1~dfsg-2+deb9u4fixed
buster, sid1:16.1.1~dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
asterisksource(unstable)1:13.1.0~dfsg-1medium771463
asterisksourcejessie1:11.13.1~dfsg-2medium
asterisksourcesqueeze(unfixed)end-of-life
asterisksourcewheezy1:1.8.13.1~dfsg1-3+deb7u4mediumDLA-455-1

Notes

[squeeze] - asterisk <end-of-life> (Unsupported in squeeze-lts)
https://issues.asterisk.org/jira/browse/ASTERISK-24469
http://downloads.digium.com/pub/security/AST-2014-012.html

Search for package or bug name: Reporting problems