Bug 1166675 (CVE-2014-8412)
| Summary: | CVE-2014-8412 asterisk: Mixed IP address families in access control lists may permit unwanted traffic [AST-2014-012] | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Martin Prpič <mprpic> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED UPSTREAM | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | itamar, jeff, lmadsen, rbryant |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-08 02:36:30 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1166676, 1166677 | ||
| Bug Blocks: | |||
Created asterisk tracking bugs for this issue: Affects: fedora-all [bug 1166676] Affects: epel-6 [bug 1166677] This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products. |
The following issue was made public in the AST-2014-012 advisory [1][2]: Many modules in Asterisk that service incoming IP traffic have ACL options ("permit" and "deny") that can be used to whitelist or blacklist address ranges. A bug has been discovered where the address family of incoming packets is only compared to the IP address family of the first entry in the list of access control rules. If the source IP address for an incoming packet is not of the same address family as the first ACL entry, that packet bypasses all ACL rules. For ACLs whose rules are all of the same address family, there is no issue. Note that while the incoming packet may bypass ACL rules, the packet is still subject to any authentication requirements that the specific protocol employs. This issue affects the following parts of Asterisk * All VoIP channel drivers * DUNDi * Asterisk Manager Interface (AMI) Patches for this issue are linked to in the AST-2014-012 [1][2] advisory. References: [1] http://downloads.asterisk.org/pub/security/AST-2014-012.pdf [2] http://seclists.org/fulldisclosure/2014/Nov/65