Description
SQL injection vulnerability in the Postgres Realtime Engine (res_config_pgsql) in Asterisk 1.4.x before 1.4.15 and C.x before C.1.0-beta6 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asterisk | 1:1.4.15~dfsg-1 | — |
References
- 38933 vdb-entry
- 1019021 vdb-entry
- 20071129 AST-2007-025 - SQL Injection issue in res_config_pgsql mailing-list
- ADV-2007-4055 vdb-entry
- http://downloads.digium.com/pub/security/AST-2007-025.html
- 27873 third-party-advisory
- 26645 vdb-entry
- asterisk-resconfigpgsql-sql-injection(38766) vdb-entry