An Asterisk Manager Interface security check bypass was found in the way Asterisk performed user access check during the originate manager action. A remote authenticated user, with manager privilege, could use this flaw to escalate their privileges and execute arbitrary shell commands via an 'Async' header sent together with 'Application' header during the manager Originate action. References: [1] http://downloads.asterisk.org/pub/security/AST-2011-006.html Upstream patches: [2] http://downloads.asterisk.org/pub/security/AST-2011-006-1.4.diff (against v1.4 branch) [3] http://downloads.asterisk.org/pub/security/AST-2011-006-1.6.1.diff (against v1.6.1 branch) [4] http://downloads.asterisk.org/pub/security/AST-2011-006-1.6.2.diff (against v1.6.2 branch) [5] http://downloads.asterisk.org/pub/security/AST-2011-006-1.8.diff (against v1.8 branch)
This issue affects the versions of asterisk package, as shipped with Fedora release of 13 and 14. This issue affects the version of the asterisk package, as present within EPEL-6 repository. Please schedule an update.
Created asterisk tracking bugs for this issue Affects: fedora-all [bug 698918] Affects: epel-6 [bug 698919]
CVE Request: [6] http://www.openwall.com/lists/oss-security/2011/04/21/5
The CVE identifier of CVE-2011-1599 has been assigned to this issue: [7] http://www.openwall.com/lists/oss-security/2011/04/22/6
This is corrected via these builds that have the fixes from upstream: Fedora-13: asterisk-1.6.2.18-1.fc13 Fedora-14: asterisk-1.6.2.18-1.fc14 Fedora-15: asterisk-1.8.3.3-1.fc15 Fedora-Rawhide: asterisk-1.8.3.3-1.fc16 EPEL-6: asterisk-1.8.3.3-1.el6