NVD

Id
62985  
Name
CVE-2006-4346  
Description
Asterisk 1.2.10 supports the use of client-controlled variables to determine filenames in the Record function, which allows remote attackers to (1) execute code via format string specifiers or (2) overwrite files via directory traversals involving unspecified vectors, as demonstrated by the CALLERIDNAME variable.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2016-12-20  
Published
2006-08-24  
Modified Date
2011-03-07  
Seq
2006-4346  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
327937 62985 CVE-2006-4346 http://labs.musecurity.com/advisories/MU-200608-01.txt  View
327938 62985 CVE-2006-4346 1016742  View
327939 62985 CVE-2006-4346 GLSA-200610-15  View
327940 62985 CVE-2006-4346 20060825 Multiple Vulnerabilities in Asterisk 1.2.10 (Fixed in 1.2.11)  View
327941 62985 CVE-2006-4346 19683  View
327942 62985 CVE-2006-4346 http://www.sineapps.com/news.php?rssid=1448  View
327943 62985 CVE-2006-4346 ADV-2006-3372  View
327944 62985 CVE-2006-4346 asterisk-record-code-execution(28544)  View
327945 62985 CVE-2006-4346 asterisk-record-directory-traversal(28564)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
58860 JVNDB-2006-001126 Asterisk におけるファイルを上書きされる脆弱性 Asterisk は、Record 関数のファイル名を決定するクライアント制御の変数の使用を支援するため、以下の脆弱性が存在します。 CVE-2006-4346 20448 CVE-2006-4346 62985 7.5 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-001126.html 2006-08-24 2012-06-26 View