Description
main/acl.c in Asterisk Open Source 1.6.0.x before 1.6.0.25, 1.6.1.x before 1.6.1.17, and 1.6.2.x before 1.6.2.5 does not properly enforce remote host access controls when CIDR notation "/0" is used in permit= and deny= configuration rules, which causes an improper arithmetic shift and might allow remote attackers to bypass ACL rules and access services from unauthorized hosts.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.securityfocus.com/archive/1/509757/100/0/threaded ↗
- http://downloads.asterisk.org/pub/security/AST-2010-003.html ↗
- http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.2.diff ↗
- http://secunia.com/advisories/39096 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037679.html ↗
- http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff ↗
- http://www.vupen.com/english/advisories/2010/0475 ↗
- http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff ↗
- http://osvdb.org/62588 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56552 ↗
- http://www.securityfocus.com/bid/38424 ↗
- http://secunia.com/advisories/38752 ↗