An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue in the action_listcategories() function of Sangoma Asterisk     v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal.
    (CVE-2024-53566)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue in the action_listcategories() function of Sangoma Asterisk
    v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal.
    (CVE-2024-53566)

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4042 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4042-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     February 06, 2025                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : asterisk     Version        : 1:16.28.0~dfsg-0+deb11u6     CVE ID         : CVE-2024-53566     Debian Bug     :

    An issue has been found in asterisk, an Open Source Private Branch     Exchange.

    CVE-2024-53566

       It is possible to access files outside the configuration directory        via AMI and path traversal even when live_dangerously is not        enabled.

    For Debian 11 bullseye, this problem has been fixed in version     1:16.28.0~dfsg-0+deb11u6.

    We recommend that you upgrade your asterisk packages.

    For the detailed security status of asterisk please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/asterisk

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS


    Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7624c151-d116-11ef-b232-b42e991fc52e advisory.

    cve@mitre.org reports:
    An issue in the action_listcategories() function of Sangoma Asterisk             v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to             execute a path traversal.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
252350	Linux Distros Unpatched Vulnerability : CVE-2024-53566	Nessus	Misc.	medium
423674	Alpine: multiple asterisk packages: security update to 20.11.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
423674	Alpine: multiple asterisk packages: security update to 20.11.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
215046	Debian dla-4042 : asterisk - security update	Nessus	Debian Local Security Checks	medium
214000	FreeBSD : asterisk - path traversal (7624c151-d116-11ef-b232-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	medium
408577	Alpine: asterisk: security update to 18.24.3-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
408577	Alpine: asterisk: security update to 18.24.3-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
408576	Alpine: asterisk: security update to 20.9.3-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
408576	Alpine: asterisk: security update to 20.9.3-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium

Detections

Analytics

CVE-2024-53566

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium