CVE-2005-3559 Path traversal in n/a

What is CVE-2005-3559?

CVE-2005-3559 is a medium-severity path traversal vulnerability in Digium Asterisk, published on 16 Nov 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a .. (dot dot) in the folder parameter.

Which versions are affected by CVE-2005-3559?

It affects 1 product.

Products include Digium Asterisk.

How do I fix CVE-2005-3559?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2005-3559 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2005-3559 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in Digium Asterisk

• CVE-2017-14100 Command injection in n/a Critical 9.8
• CVE-2014-8418 Privilege escalation in n/a Critical 9.0
• CVE-2011-1599 Missing authorization in n/a Critical 9.0
• CVE-2017-16671 Memory corruption in n/a High 8.8
• CVE-2017-7617 Memory corruption in n/a High 8.8

All Digium Asterisk vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2005-3559, GHSA-429c-7p43-rw2j.