CVE-2014-8412

published 2014-11-24

CVE-2014-8412: The (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x…

Priority P4 30 medium 5 CVSS 2.0

AV N AC L Au N C N I P A N

The (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 allows remote attackers to bypass the ACL restrictions via a packet with a source IP that does not share the address family as the first ACL entry.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
debian	asterisk	< asterisk 1:13.1.0~dfsg-1 (bullseye)	asterisk 1:13.1.0~dfsg-1 (bullseye)
digium	asterisk	>= 0 < 1:13.1.0~dfsg-1	1:13.1.0~dfsg-1
digium	asterisk	>= 1.8.0 < 1.8.32.1	1.8.32.1
digium	asterisk	>= 11.0.0 < 11.14.1	11.14.1
digium	asterisk	>= 12.0.0 < 12.7.1	12.7.1
digium	asterisk	>= 13.0.0 < 13.0.1	13.0.1
digium	certified_asterisk	—	—
digium	certified_asterisk	—	—
digium	certified_asterisk	—	—
digium	certified_asterisk	—	—

CVSS provenance

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:P/A:N

osv 5.0 MEDIUM

vendor_debian 5.0 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-264