Published: 16/11/2005 Updated: 19/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 505

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 up to and including 1.2.0-beta1 allows remote malicious users to access WAV files via a .. (dot dot) in the folder parameter.

Vulnerable Product	Search on Vulmon	Subscribe to Product
digium asterisk 0.1.1
digium asterisk 0.1.10
digium asterisk 0.1.11
digium asterisk 0.1.7
digium asterisk 0.1.8
digium asterisk 0.7.1
digium asterisk 0.7.2
digium asterisk 1.0.6
digium asterisk 1.0.7
digium asterisk 1.0.8
digium asterisk 0.1.0
digium asterisk 0.1.5
digium asterisk 0.1.6
digium asterisk 0.5.0
digium asterisk 0.7.0
digium asterisk 1.0.4
digium asterisk 1.0.5
digium asterisk 0.1.12
digium asterisk 0.1.2
digium asterisk 0.1.9
digium asterisk 0.2.0
digium asterisk 1.0.0
digium asterisk 1.0.1
digium asterisk 1.0.9
digium asterisk 1.0_rc1
digium asterisk 0.1.3
digium asterisk 0.1.4
digium asterisk 0.3.0
digium asterisk 0.4.0
digium asterisk 1.0.2
digium asterisk 1.0.3
digium asterisk 1.0_rc2
digium asterisk 1.2.0_beta1

Debian Bug report logs - #338116 asterisk-web-vmail: Information disclosure of voice mail messages through vmailcgi Package: asterisk-web-vmail; Maintainer for asterisk-web-vmail is (unknown); Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Tue, 8 Nov 2005 09:33:14 UTC Severity: important Tags: patch, security Fo ...

Several problems have been discovered in Asterisk, an Open Source Private Branch Exchange (telephone control center) The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2005-3559 Adam Pointon discovered that due to missing input sanitising it is possible to retrieve recorded phone messages for a differe ...

source: wwwsecurityfocuscom/bid/15336/info Asterisk is prone to an unauthorized-access vulnerability This issue is due to a failure in the application to properly verify user-supplied input Successful exploitation will grant an attacker access to a victim user's voicemail and to any 'wav/WAV' files currently on the affected system ...

NVD-CWE-Other http://www.assurance.com.au/advisories/200511-asterisk.txt http://secunia.com/advisories/17459 http://securitytracker.com/id?1015164 http://www.securityfocus.com/bid/15336 http://osvdb.org/20577 http://www.debian.org/security/2006/dsa-1048 http://secunia.com/advisories/19872 http://www.vupen.com/english/advisories/2005/2346 https://exchange.xforce.ibmcloud.com/vulnerabilities/23002 http://www.securityfocus.com/archive/1/415990/30/0/threaded https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=338116 https://nvd.nist.gov https://www.exploit-db.com/exploits/26475/https://www.debian.org/security/./dsa-1048

CVE-2005-3559

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect