Condorlab

Asterisk – Bypass ACL Restriction on Different Asterisk Products


Advisory ID

RSN-PBX-0001


Vulnerability Information

 

 

Is possible to bypass the whitelist and blacklist that can be created on various modules in Asterisk via ACL options. There is a bug on the ACL code where an attacker can bypass them using a packet with a source IP that does not match the address family as the first ACL entry.

The vulnerability affects all VoIP driver channels, DUNDi and Asterisk Manager Interface (AMI).


Technical Information

 

 

Many modules in Asterisk that service incoming IP traffic have ACL options (“permit” and “deny”) that can be used to whitelist or blacklist address ranges. A bug has been discovered where the address family of incoming packets is only compared to the IP address family of the first entry in the list of access control rules. If the source IP address for an incoming packet is not of the same address family as the first ACL entry, that packet bypasses all ACL rules. For ACLs whose rules are all of the same address family, there is no issue.


 

Release Date

22/10/2014


Solutions

 

The UCTM solution from RedShift Networks provides the industry’s first complete security solution developed to secure VOIP networks, endpoints and applications. His research team Condor-Labs.com is constantly looking for new attack patterns, advanced penetration testing methods, vulnerability identification and deployment of new signatures for constantly subscribed clients. For more information visit www.redshiftnetworks.com


External Resources

 

 

Common Vulnerabilities and Exposures (CVE)

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8412

Asterisk Project Security Advisory

http://downloads.asterisk.org/pub/security/AST-2014-012.html