Description
The Asterisk Extension Language (AEL) in pbx/pbx_ael.c in Asterisk does not properly generate extensions, which allows remote attackers to execute arbitrary extensions and have an unknown impact by specifying an invalid extension in a certain form.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asterisk | 1:1.4.0~dfsg-1 | — |
References
- 23155 vdb-entry
- http://svn.digium.com/view/asterisk?rev=59073&view=rev
- SUSE-SA:2007:034 vendor-advisory
- http://bugs.digium.com/view.php?id=9316
- 25582 third-party-advisory
- 24694 third-party-advisory
- ADV-2007-1123 vdb-entry