Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Asterisk 1.2.10 supports the use of client-controlled variables to determine filenames in the Record function, which allows remote attackers to (1) execute code via format string specifiers or (2) overwrite files via directory traversals involving unspecified vectors, as demonstrated by the CALLERIDNAME variable.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Asterisk Record()文件名目录遍历漏洞
Vulnerability Description
Asterisk是一款PBX系统的软件，运行在Linux系统上，支持使用SIP、IAX、H323协议进行IP通话。 Asterisk在处理发送给Record()应用的文件名时存在漏洞，可能允许攻击者通过目录遍历技术发送格式字符串导致执行任意代码。但是，这个漏洞影响较小，因为必须要求管理员使用客户端控制的变量做为文件名的一部分。
CVSS Information
N/A
Vulnerability Type
N/A