CVE-2010-1224
- State
- Published
- Severity
- Not scored
- Published
- Apr 1, 2010
- Updated
- Aug 7, 2024
- Reserved
- Apr 1, 2010
Description
main/acl.c in Asterisk Open Source 1.6.0.x before 1.6.0.25, 1.6.1.x before 1.6.1.17, and 1.6.2.x before 1.6.2.5 does not properly enforce remote host access controls when CIDR notation "/0" is used in permit= and deny= configuration rules, which causes an improper arithmetic shift and might allow remote attackers to bypass ACL rules and access services from unauthorized hosts.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 20100225 AST-2010-003: Invalid parsing of ACL rules can compromise securitymailing-list
- http://downloads.asterisk.org/pub/security/AST-2010-003.html
- http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.2.diff
- 39096third-party-advisory
- FEDORA-2010-3724vendor-advisory
- http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff
- ADV-2010-0475vdb-entry
- http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff
- 62588vdb-entry
- asterisk-cidr-security-bypass(56552)vdb-entry
- 38424vdb-entry
- 38752third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.