SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments.

The remote host is affected by the vulnerability described in GLSA-200804-13 (Asterisk: Multiple vulnerabilities)

    Asterisk upstream developers reported multiple vulnerabilities:
    The Call Detail Record Postgres logging engine (cdr_pgsql)     does not correctly escape the ANI and DNIS arguments before using them     in SQL statements (CVE-2007-6170).
    When using database-based     registrations ('realtime') and host-based authentication, Asterisk does     not check the IP address when the username is correct and there is no     password provided (CVE-2007-6430).
    The SIP channel driver does     not correctly determine if authentication is required     (CVE-2008-1332).
  Impact :

    Remote authenticated attackers could send specially crafted data to     Asterisk to execute arbitrary SQL commands and compromise the     administrative database. Remote unauthenticated attackers could bypass     authentication using a valid username to hijack other user's sessions,     and establish sessions on the SIP channel without authentication.
  Workaround :

    There is no known workaround at this time.

Attackers could bypass host based authentication by using a valid username (CVE-2007-6430)

Attackers could inject SQL commands under certain circumstances if 'cdr_pgsql' was used (CVE-2007-6170)

Tilghman Lesher discovered that the logging engine of Asterisk, a free software PBX and telephony toolkit, performs insufficient sanitising of call-related data, which may lead to SQL injection.

ID	Name	Product	Family	Severity
31960	GLSA-200804-13 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
31390	openSUSE 10 Security Update : asterisk (asterisk-5062)	Nessus	SuSE Local Security Checks	medium
29191	Debian DSA-1417-1 : asterisk - missing input sanitising	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2007-6170

high

Tenable Plugins

high

medium

medium