Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The design of the dialplan functionality in Asterisk Open Source 1.2.x, 1.4.x, and 1.6.x; and Asterisk Business Edition B.x.x and C.x.x, when using the ${EXTEN} channel variable and wildcard pattern matches, allows context-dependent attackers to inject strings into the dialplan using metacharacters that are injected when the variable is expanded, as demonstrated using the Dial application to process a crafted SIP INVITE message that adds an unintended outgoing channel leg. NOTE: it could be argued that this is not a vulnerability in Asterisk, but a class of vulnerabilities that can occur in any program that uses this feature without the associated filtering functionality that is already available.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Digium Asterisk design功能模块${EXTEN}变量和通配符模式漏洞
Vulnerability Description
Asterisk是一种开放源代码的通信平台。 Asterisk开源design功能模块中变量和通配符模式漏洞，当使用${EXTEN}变量和通配符模式匹配，允许关联攻击者使用匹配字符注入代码进入dialplan，注入变量扩大，同样证明使用Dial功能处理一个自制的SIP INVITE消息加入一个无效路径。
CVSS Information
N/A
Vulnerability Type
N/A