CVE-2014-8412 Security feature bypass in n/a
Remote attackers can bypass Access Control List restrictions in Asterisk VoIP, DUNDi, and AMI components by sending packets with mismatched address families.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-8412?
CVE-2014-8412 is a medium-severity vulnerability in Digium Asterisk, published on 24 Nov 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 allows remote attackers to bypass the ACL restrictions via a packet with a source IP that does not share the address family as the first ACL entry.
Weakness: CWE-264
Which versions are affected by CVE-2014-8412?
It affects 2 products.
Products include Digium Asterisk, Digium Certified Asterisk.
How do I fix CVE-2014-8412?
Upgrade to a fixed version.
Is CVE-2014-8412 being exploited?
There is no known exploitation of CVE-2014-8412 in the wild and no public exploit code.
Other vulnerabilities in Digium Asterisk
Sources
Also known as DEBIAN-CVE-2014-8412, GHSA-hr4p-r869-mq9r.