CVE-2014-4046

Published: Jun 17, 2014Modified: May 6, 2026

6.5

Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability: 8.0 / Impact: 6.4

Source: NVD

Description

Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action.

Affected (54)

Products: Digium: Asterisk, Certified Asterisk

Digium

2 products

Asterisk

Certified Asterisk

Configuration A

34 vulnerable

Vulnerable Software	Affected Versions
Digium Asterisk	Version 11.0.0
Digium Asterisk	Version 11.0.0 beta1
Digium Asterisk	Version 11.0.0 beta2
Digium Asterisk	Version 11.0.0 rc1
Digium Asterisk	Version 11.0.0 rc2
Digium Asterisk	Version 11.0.1
Digium Asterisk	Version 11.0.2
Digium Asterisk	Version 11.1.0
Digium Asterisk	Version 11.1.0 rc1
Digium Asterisk	Version 11.1.0 rc3
Digium Asterisk	Version 11.1.1
Digium Asterisk	Version 11.1.2
Digium Asterisk	Version 11.10.0
Digium Asterisk	Version 11.10.0 rc1
Digium Asterisk	Version 11.2.0 rc1
Digium Asterisk	Version 11.2.0 rc2
Digium Asterisk	Version 11.3.0 rc1
Digium Asterisk	Version 11.3.0 rc2
Digium Asterisk	Version 11.4.0
Digium Asterisk	Version 11.4.0 rc1
Digium Asterisk	Version 11.4.0 rc2
Digium Asterisk	Version 11.4.0 rc3
Digium Asterisk	Version 11.5.0
Digium Asterisk	Version 11.5.0 rc1
Digium Asterisk	Version 11.5.0 rc2
Digium Asterisk	Version 11.5.1
Digium Asterisk	Version 11.8.0
Digium Asterisk	Version 11.8.0 rc1
Digium Asterisk	Version 11.8.0 rc2
Digium Asterisk	Version 11.8.0 rc3
Digium Asterisk	Version 11.8.1
Digium Asterisk	Version 11.9.0
Digium Asterisk	Version 11.9.0 rc1
Digium Asterisk	Version 11.9.0 rc2

Configuration B

13 vulnerable

Vulnerable Software	Affected Versions
Digium Asterisk	Version 12.0.0
Digium Asterisk	Version 12.1.0
Digium Asterisk	Version 12.1.0 rc1
Digium Asterisk	Version 12.1.0 rc2
Digium Asterisk	Version 12.1.0 rc3
Digium Asterisk	Version 12.1.1
Digium Asterisk	Version 12.2.0
Digium Asterisk	Version 12.2.0 rc1
Digium Asterisk	Version 12.2.0 rc2
Digium Asterisk	Version 12.2.0 rc3
Digium Asterisk	Version 12.3.0
Digium Asterisk	Version 12.3.0 rc1
Digium Asterisk	Version 12.3.0 rc2

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Digium Certified Asterisk	Version 11.6.0
Digium Certified Asterisk	Version 11.6.0 rc1
Digium Certified Asterisk	Version 11.6.0 rc2
Digium Certified Asterisk	Version 11.6 cert1
Digium Certified Asterisk	Version 11.6 cert1_rc1
Digium Certified Asterisk	Version 11.6 cert1_rc2
Digium Certified Asterisk	Version 11.6 cert2

References (6)

http://downloads.asterisk.org/pub/security/AST-2014-006.html

Source: cve@mitre.org

PatchVendor Advisory

http://packetstormsecurity.com/files/127088/Asterisk-Project-Security-Advisory-AST-2014-006.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/532419/100/0/threaded

Source: cve@mitre.org

http://downloads.asterisk.org/pub/security/AST-2014-006.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://packetstormsecurity.com/files/127088/Asterisk-Project-Security-Advisory-AST-2014-006.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/532419/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.