CVE-2017-14100 — CRITICAL (9.8)

Vulnerability Description

In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command execution is possible. The app_minivm module has an "externnotify" program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source, a crafted caller-id name or number allows an arbitrary shell command injection.

CVSS Score

9.8

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Digium	Asterisk	13.0.0
Digium	Certified Asterisk	11.6

Related Weaknesses (CWE)

CWE-78

References

http://downloads.asterisk.org/pub/security/AST-2017-006.htmlVendor Advisory
http://www.debian.org/security/2017/dsa-3964
http://www.securitytracker.com/id/1039252Third Party AdvisoryVDB Entry
https://bugs.debian.org/873908Issue TrackingPatchThird Party Advisory
https://issues.asterisk.org/jira/browse/ASTERISK-27103Issue TrackingPatchThird Party Advisory
https://security.gentoo.org/glsa/201710-29
http://downloads.asterisk.org/pub/security/AST-2017-006.htmlVendor Advisory
http://www.debian.org/security/2017/dsa-3964
http://www.securitytracker.com/id/1039252Third Party AdvisoryVDB Entry
https://bugs.debian.org/873908Issue TrackingPatchThird Party Advisory
https://issues.asterisk.org/jira/browse/ASTERISK-27103Issue TrackingPatchThird Party Advisory
https://security.gentoo.org/glsa/201710-29

FAQ

What is CVE-2017-14100?

CVE-2017-14100 is a vulnerability with a CVSS score of 9.8 (CRITICAL). In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command execution is possible. The...

How severe is CVE-2017-14100?

CVE-2017-14100 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2017-14100?

Check the references section above for vendor advisories and patch information. Affected products include: Digium Asterisk, Digium Certified Asterisk.