Digium Asterisk Multiple Vulnerabilities Advisory (CVE-2019-18790/18976/18610)

Critical Vulnerability Information Overview Title: Multiple vulnerabilities in Digium Asterisk and Certified Asterisk Release Date: 2019-11-22 Risk Level: High Vulnerability Details Number of Vulnerabilities: 3 CVE-ID: - CVE-2019-18790 - CVE-2019-18976 - CVE-2019-18610 CWE-ID: - CWE-284 - CWE-20 - CWE-78 Vulnerability Status Exploit Vector: Network Known Public Exploits: No Affected Software: - Asterisk Open Source - Certified Asterisk Vendor: Digium (Linux Support Services) Security Advisory This security advisory contains information about 3 vulnerabilities. 1) Improper Access Control Risk: Medium CVSS v4.0: 2.7 CVE-ID: CVE-2019-18790 CWE-ID: CWE-284 Exploitability: No Description: Remote attackers can access restricted functions without proper authorization. Mitigation: Install updates from the vendor's website. Affected Software Versions: - Asterisk Open Source: 13.0.0 - 17.0.0 - Certified Asterisk: 13.21 - 13.21-cert4 2) Input Validation Error Risk: Medium CVSS v4.0: 6.6 CVE-ID: CVE-2019-18976 CWE-ID: CWE-20 Exploitability: No Description: Remote attackers can perform a Denial of Service (DoS) attack. Mitigation: Install updates from the vendor's website. Affected Software Versions: - Asterisk Open Source: 13.0.0 - 13.29.1 - Certified Asterisk: 13.21 - 13.21-cert4 3) OS Command Injection Risk: High CVSS v4.0: 6.3 CVE-ID: CVE-2019-18610 CWE-ID: CWE-78 Exploitability: No Description: Remote attackers can execute arbitrary shell commands on the target system. Mitigation: Install updates from the vendor's website. Affected Software Versions: - Asterisk Open Source: 13.0.0 - 17.0.0 - Certified Asterisk: 13.21 - 13.21-cert4

Goal Reached Thanks to every supporter — we hit 100%!

Digium Asterisk Multiple Vulnerabilities Advisory (CVE-2019-18790/18976/18610)