Description
main/acl.c in Asterisk Open Source 1.6.0.x before 1.6.0.25, 1.6.1.x before 1.6.1.17, and 1.6.2.x before 1.6.2.5 does not properly enforce remote host access controls when CIDR notation "/0" is used in permit= and deny= configuration rules, which causes an improper arithmetic shift and might allow remote attackers to bypass ACL rules and access services from unauthorized hosts.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asterisk | 1:1.6.2.6-1 | — |
References
- 20100225 AST-2010-003: Invalid parsing of ACL rules can compromise security mailing-list
- http://downloads.asterisk.org/pub/security/AST-2010-003.html
- http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.2.diff
- 39096 third-party-advisory
- FEDORA-2010-3724 vendor-advisory
- http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff
- ADV-2010-0475 vdb-entry
- http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff
- 62588 vdb-entry
- asterisk-cidr-security-bypass(56552) vdb-entry
- 38424 vdb-entry
- 38752 third-party-advisory