channels/chan_iax2.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert7, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 does not enforce ACL rules during certain uses of peer credentials, which allows remote authenticated users to bypass intended outbound-call restrictions by leveraging the availability of these credentials.

The remote host is affected by the vulnerability described in GLSA-201209-15 (Asterisk: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in Asterisk:
      An error in manager.c allows shell access (CVE-2012-2186).
      An error in Asterisk could cause all RTP ports to be exhausted         (CVE-2012-3812).
      A double-free error could occur when two parties attempt to         manipulate the same voicemail account simultaneously (CVE-2012-3863).
      Asterisk does not properly implement certain ACL rules         (CVE-2012-4737).
  Impact :

    A remote, authenticated attacker could execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or bypass       outbound call restrictions.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities were discovered in Asterisk, a PBX and telephony toolkit, allowing privilege escalation in the Asterisk Manager, denial of service or privilege escalation.

More detailed information can be found in the Asterisk advisories:
AST-2012-010, AST-2012-011, AST-2012-012, and AST-2012-013.

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by a vulnerability that could allow a remote, authenticated attacker to bypass access controls on out-bound calls.

Inter-Asterisk eXchange (IAX2) out-bound call restrictions can be bypassed if peer credentials, defined in a dynamic Asterisk Realtime Architecture (ARA) backend, are used by an attacker.

Asterisk project reports :

Asterisk Manager User Unauthorized Shell Access

ACL rules ignored when placing outbound calls by certain IAX2 users

ID	Name	Product	Family	Severity
62344	GLSA-201209-15 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
62188	Debian DSA-2550-2 : asterisk - several vulnerabilities	Nessus	Debian Local Security Checks	high
61994	Asterisk Peer IAX2 Call Handling ACL Rule Bypass (AST-2012-013)	Nessus	Misc.	medium
61742	FreeBSD : asterisk -- multiple vulnerabilities (4c53f007-f2ed-11e1-a215-14dae9ebcf89)	Nessus	FreeBSD Local Security Checks	high
6568	Asterisk Peer IAX2 Call Handling ACL Rule Bypass (AST-2012-013)	Nessus Network Monitor	Generic	medium

Detections

Analytics

CVE-2012-4737

high

Tenable Plugins

high

high

medium

high

medium