CVE-2017-14100

In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command execution is possible. The app_minivm module has an "externnotify" program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source, a crafted caller-id name or number allows an arbitrary shell command injection.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:digium:asterisk:13.0.0:*:*:*:lts:*:*:*
cpe:2.3:a:digium:asterisk:13.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.0.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.0.2:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.1.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.1.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.1.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.1.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.2.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.2.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.2.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.3.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.3.2:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.4.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.4.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.5.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.5.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.6.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.7.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.7.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.7.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.7.2:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.8.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.8.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.8.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.8.2:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.9.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.9.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.10.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.10.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.11.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.11.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.11.2:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.12:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.12.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.12.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.12.2:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.13:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.13.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.13.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.14.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.14.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.14.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.14.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.15.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.15.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.15.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.15.0:rc3:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.15.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.16.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.16.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.16.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.17.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:13.17.0:rc1:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:digium:asterisk:14.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.0.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.0.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.0.2:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.01:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.1.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.1.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.1.2:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.02:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.2:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.2.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.2.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.3.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.3.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.3.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.3.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.4.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.4.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.4.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.4.0:rc3:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.4.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.5.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.5.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.5.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.6.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:14.6.0:rc1:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:digium:asterisk:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.0.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.0.2:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.1.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.1.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.1.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.1.0:rc3:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.1.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.1.2:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.2.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.2.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.2.2:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.4.0:rc4:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.6.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.6.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.6.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.6.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.7.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.7.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.7.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.8.0:-:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.8.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.8.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.8.0:rc3:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.8.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.9.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.9.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.9.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.9.0:rc3:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.10.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.10.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.10.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.10.1:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.10.2:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.11.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.11.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.12.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.12.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.12.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.13.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.13.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.13.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.14.0:*:*:*:lts:*:*:*
cpe:2.3:a:digium:asterisk:11.14.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.14.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.14.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.14.2:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.15.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.15.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.15.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.16.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.17.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.17.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.18.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.18.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.19.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.20.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.21.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.21.0:rc2:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.21.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.21.2:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.22.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.22.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.23.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.23.0:rc1:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.23.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.24.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.24.1:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.25.0:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:11.25.1:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:digium:certified_asterisk:11.6:cert1:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert1_rc1:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert1_rc2:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert10:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert11:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert12:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert13:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert14:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert14_rc1:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert14_rc2:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert15:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert16:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert2:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert3:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert4:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert5:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert6:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert7:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert8:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert9:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:digium:certified_asterisk:13.13:cert1:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert1_rc1:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert1_rc2:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert1_rc3:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert1_rc4:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert2:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert3:*:*:*:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert4:*:*:*:*:*:*

History

21 Nov 2024, 03:12

Type Values Removed Values Added
References () http://downloads.asterisk.org/pub/security/AST-2017-006.html - Vendor Advisory () http://downloads.asterisk.org/pub/security/AST-2017-006.html - Vendor Advisory
References () http://www.debian.org/security/2017/dsa-3964 - () http://www.debian.org/security/2017/dsa-3964 -
References () http://www.securitytracker.com/id/1039252 - Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1039252 - Third Party Advisory, VDB Entry
References () https://bugs.debian.org/873908 - Issue Tracking, Patch, Third Party Advisory () https://bugs.debian.org/873908 - Issue Tracking, Patch, Third Party Advisory
References () https://issues.asterisk.org/jira/browse/ASTERISK-27103 - Issue Tracking, Patch, Third Party Advisory () https://issues.asterisk.org/jira/browse/ASTERISK-27103 - Issue Tracking, Patch, Third Party Advisory
References () https://security.gentoo.org/glsa/201710-29 - () https://security.gentoo.org/glsa/201710-29 -

Information

Published : 2017-09-02 16:29

Updated : 2024-11-21 03:12


NVD link : CVE-2017-14100

Mitre link : CVE-2017-14100

CVE.ORG link : CVE-2017-14100


JSON object : View

Products Affected

digium

  • asterisk
  • certified_asterisk
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')