CVE-2012-2186 Command injection in n/a
Remote authenticated users with originate privileges can execute arbitrary commands via the AMI Originate action in Asterisk.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-2186?
CVE-2012-2186 is a critical command injection vulnerability in n/a, published on 31 Aug 2012. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 allows remote authenticated users to execute arbitrary commands by leveraging originate privileges and providing an ExternalIVR value in an AMI Originate action.
Which versions are affected by CVE-2012-2186?
It affects 5 products.
Products include Asterisk Business Edition, Asterisk Certified Asterisk, Asterisk Digiumphones, Asterisk Open Source, Sangoma Asterisk.
How do I fix CVE-2012-2186?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2012-2186 being exploited?
There is no known exploitation of CVE-2012-2186 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2012-2186, GHSA-27ch-ccxg-45pf.