CVE-2011-1599 Missing authorization in n/a
Remote authenticated users can execute arbitrary commands via the Manager Interface due to improper privilege checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-1599?
CVE-2011-1599 is a critical missing authorization vulnerability in Digium Asterisk, published on 27 Apr 2011. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
manager.c in the Manager Interface in Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 does not properly check for the system privilege, which allows remote authenticated users to execute arbitrary commands via an Originate action that has an Async header in conjunction with an Application header.
Weakness: CWE-20
Which versions are affected by CVE-2011-1599?
It affects 1 product.
Products include Digium Asterisk.
How do I fix CVE-2011-1599?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2011-1599 being exploited?
There is no known exploitation of CVE-2011-1599 in the wild and no public exploit code.
Other vulnerabilities in Digium Asterisk
Sources
Also known as DEBIAN-CVE-2011-1599, GHSA-9qp8-qmr4-5hp8.