CVE-2012-4737 Auth bypass in n/a
Remote authenticated users can bypass outbound-call restrictions in Asterisk by leveraging peer credentials due to missing ACL enforcement.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-4737?
CVE-2012-4737 is a medium-severity authentication bypass vulnerability in Digium Asterisk, published on 31 Aug 2012. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
channels/chan_iax2.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert7, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 does not enforce ACL rules during certain uses of peer credentials, which allows remote authenticated users to bypass intended outbound-call restrictions by leveraging the availability of these credentials.
Weakness: CWE-264
Which versions are affected by CVE-2012-4737?
It affects 2 products.
Products include Digium Asterisk, Digium Certified Asterisk.
How do I fix CVE-2012-4737?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2012-4737 being exploited?
There is no known exploitation of CVE-2012-4737 in the wild and no public exploit code.
Other vulnerabilities in Digium Asterisk
Sources
Also known as DEBIAN-CVE-2012-4737, GHSA-5hf4-mrr5-f9rh.