Multiple vulnerabilities have been found in Asterisk allowing for SQL injection, session hijacking and unauthorized usage.
Package | net-misc/asterisk on all architectures |
---|---|
Affected versions | < 1.2.27 |
Unaffected versions | >= 1.2.27 |
Asterisk is an open source telephony engine and tool kit.
Asterisk upstream developers reported multiple vulnerabilities:
Remote authenticated attackers could send specially crafted data to Asterisk to execute arbitrary SQL commands and compromise the administrative database. Remote unauthenticated attackers could bypass authentication using a valid username to hijack other user's sessions, and establish sessions on the SIP channel without authentication.
There is no known workaround at this time.
All Asterisk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.2.27"