CVE-2014-8412

NameCVE-2014-8412
DescriptionThe (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 allows remote attackers to bypass the ACL restrictions via a packet with a source IP that does not share the address family as the first ACL entry.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-455-1
NVD severitymedium
Debian Bugs771463

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
asterisk (PTS)stretch1:13.14.1~dfsg-2+deb9u4fixed
stretch (security)1:13.14.1~dfsg-2+deb9u5fixed
buster1:16.2.1~dfsg-1+deb10u2fixed
bullseye1:16.16.1~dfsg-1fixed
bookworm, sid1:16.16.1~dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
asterisksourcesqueeze(unfixed)end-of-life
asterisksourcewheezy1:1.8.13.1~dfsg1-3+deb7u4DLA-455-1
asterisksourcejessie1:11.13.1~dfsg-2
asterisksource(unstable)1:13.1.0~dfsg-1771463

Notes

[squeeze] - asterisk <end-of-life> (Unsupported in squeeze-lts)
https://issues.asterisk.org/jira/browse/ASTERISK-24469
http://downloads.digium.com/pub/security/AST-2014-012.html

Search for package or bug name: Reporting problems