GLSA-201206-05 : Asterisk: Multiple vulnerabilities
Medium Nessus Plugin ID 59633
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-201206-05 (Asterisk: Multiple vulnerabilities)
Multiple vulnerabilities have been found in Asterisk:
An error in manager.c allows shell access through the MixMonitor application, GetVar, or Status (CVE-2012-2414).
An error in chan_skinny.c could cause a heap-based buffer overflow (CVE-2012-2415).
An error in chan_sip.c prevents Asterisk from checking if a channel exists before connected line updates (CVE-2012-2416).
An error in chan_iax2.c may cause an invalid pointer to be called (CVE-2012-2947).
chan_skinny.c contains a NULL pointer dereference (CVE-2012-2948).
A remote attacker could execute arbitrary code with the privileges of the process or cause a Denial of Service condition.
There is no known workaround at this time.
SolutionAll Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=net-misc/asterisk-188.8.131.52'