CVE-2014-8417 — MEDIUM (6.5)

Q: How severe is CVE-2014-8417?

CVE-2014-8417 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2014-8417?

Check the references section above for vendor advisories and patch information. Affected products include: Digium Asterisk, Digium Certified Asterisk.

Vulnerability Description

ConfBridge in Asterisk 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 11.6 before 11.6-cert8 allows remote authenticated users to (1) gain privileges via vectors related to an external protocol to the CONFBRIDGE dialplan function or (2) execute arbitrary system commands via a crafted ConfbridgeStartRecord AMI action.

CVSS Score

6.5

MEDIUM

AV:N/AC:L/Au:S/C:P/I:P/A:P

Confidentiality

PARTIAL

Integrity

PARTIAL

Availability

PARTIAL

Affected Products

Vendor	Product	Versions
Digium	Asterisk	>= 11.0.0, < 11.14.1
Digium	Certified Asterisk	11.6

Related Weaknesses (CWE)

CWE-264

References

http://downloads.asterisk.org/pub/security/AST-2014-017.htmlVendor Advisory
http://downloads.asterisk.org/pub/security/AST-2014-017.htmlVendor Advisory

FAQ

What is CVE-2014-8417?

CVE-2014-8417 is a vulnerability with a CVSS score of 6.5 (MEDIUM). ConfBridge in Asterisk 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 11.6 before 11.6-cert8 allows remote authenticated users to (1) gain privileges via vector...

How severe is CVE-2014-8417?

CVE-2014-8417 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-8417?

Check the references section above for vendor advisories and patch information. Affected products include: Digium Asterisk, Digium Certified Asterisk.