Vulnerability CVE-2014-8418

Vulnerability Name:

CVE-2014-8418 (CCN-98869)

Assigned:

2014-11-20

Published:

2014-11-20

Updated:

2019-07-16

Summary:

The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protocol, as demonstrated by the AMI protocol.

CVSS v3 Severity:

5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

9.0 High (CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
6.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

6.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
4.8 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-264

Vulnerability Consequences:

Gain Privileges

References:

Source: MITRE
Type: CNA
CVE-2014-8418

Source: CCN
Type: Asterisk Project Security Advisory AST-2014-018
AMI permission escalation through DB dialplan function

Source: CONFIRM
Type: Vendor Advisory
http://downloads.asterisk.org/pub/security/AST-2014-018.html

Source: CCN
Type: BID-71227
Multiple Asterisk Products 'funcs/func_db.c' Remote Privilege Escalation Vulnerability

Source: XF
Type: UNKNOWN
asterisk-cve20148418-priv-esc(98869)

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2014-8418

Vulnerable Configuration:

Configuration 1:

cpe:/a:digium:certified_asterisk:1.8.28:*:*:*:*:*:*:*

OR cpe:/a:digium:certified_asterisk:1.8.28:cert1:*:*:lts:*:*:*

OR cpe:/a:digium:certified_asterisk:1.8.28:cert1-rc1:*:*:*:*:*:*

OR cpe:/a:digium:certified_asterisk:1.8.28:cert2:*:*:*:*:*:*

OR cpe:/a:digium:certified_asterisk:1.8.28:cert2:*:*:lts:*:*:*

OR cpe:/a:digium:certified_asterisk:1.8.28:cert3:*:*:*:*:*:*

OR cpe:/a:digium:certified_asterisk:1.8.28:cert4:*:*:*:*:*:*

OR cpe:/a:digium:certified_asterisk:1.8.28:cert5:*:*:*:*:*:*

OR cpe:/a:digium:certified_asterisk:11.6:cert1:*:*:*:*:*:*

OR cpe:/a:digium:certified_asterisk:11.6:cert2:*:*:*:*:*:*

OR cpe:/a:digium:certified_asterisk:11.6:cert3:*:*:*:*:*:*

OR cpe:/a:digium:certified_asterisk:11.6:cert4:*:*:*:*:*:*

OR cpe:/a:digium:certified_asterisk:11.6:cert5:*:*:*:*:*:*

OR cpe:/a:digium:certified_asterisk:11.6:cert6:*:*:*:*:*:*

OR cpe:/a:digium:certified_asterisk:11.6:cert7:*:*:*:*:*:*

OR cpe:/a:digium:certified_asterisk:11.6.0:-:*:*:*:*:*:*

Configuration 2:

cpe:/a:digium:asterisk:*:*:*:*:*:*:*:* (Version >= 1.8.0 and <= 1.8.32.0)

OR cpe:/a:digium:asterisk:*:*:*:*:*:*:*:* (Version >= 11.0.0 and < 11.14.1)

OR cpe:/a:digium:asterisk:*:*:*:*:*:*:*:* (Version >= 12.0.0 and < 12.7.1)

Configuration CCN 1:

cpe:/a:digium:certified_asterisk:11.6:*:*:*:*:*:*:*

OR cpe:/a:digium:certified_asterisk:1.8.28:-:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.bionic:def:201484180000000	V	CVE-2014-8418 on Ubuntu 18.04 LTS (bionic) - medium.	2014-11-24
oval:com.ubuntu.artful:def:20148418000	V	CVE-2014-8418 on Ubuntu 17.10 (artful) - medium.	2014-11-24
oval:com.ubuntu.trusty:def:20148418000	V	CVE-2014-8418 on Ubuntu 14.04 LTS (trusty) - medium.	2014-11-24
oval:com.ubuntu.xenial:def:201484180000000	V	CVE-2014-8418 on Ubuntu 16.04 LTS (xenial) - medium.	2014-11-24
oval:com.ubuntu.bionic:def:20148418000	V	CVE-2014-8418 on Ubuntu 18.04 LTS (bionic) - medium.	2014-11-24
oval:com.ubuntu.xenial:def:20148418000	V	CVE-2014-8418 on Ubuntu 16.04 LTS (xenial) - medium.	2014-11-24
oval:com.ubuntu.disco:def:201484180000000	V	CVE-2014-8418 on Ubuntu 19.04 (disco) - medium.	2014-11-24
oval:com.ubuntu.cosmic:def:20148418000	V	CVE-2014-8418 on Ubuntu 18.10 (cosmic) - medium.	2014-11-24
oval:com.ubuntu.cosmic:def:201484180000000	V	CVE-2014-8418 on Ubuntu 18.10 (cosmic) - medium.	2014-11-24
oval:com.ubuntu.precise:def:20148418000	V	CVE-2014-8418 on Ubuntu 12.04 LTS (precise) - medium.	2014-11-24

BACK