A weakness has been reported in Asterisk, which can lead to unintended configurations.

The problem is that certain wildcard patterns in combination with e.g. the "${EXTEN}" channel variable in a dialplan can lead to a configuration that allows passing additional arguments to certain applications (e.g. "Dial()"). The problem occurs when a channel technology is used that accepts characters other than numbers and letters (e.g. SIP).

The weakness is reported in the following products and versions:
* Asterisk Open Source 1.2.x (all versions)
* Asterisk Open Source 1.4.x (all versions)
* Asterisk Open Source 1.6.x (all versions)
* Asterisk Business Edition B.x.x (all versions)
* Asterisk Business Edition C.x.x (all versions)

Solution
The vendor recommends to check existing configurations and apply security best practices (please see the vendor's advisory for details).

Provided and/or discovered by
The vendor credits Hans Petter Selasky.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://downloads.asterisk.org/pub/security/AST-2010-002.html

Deep Links
Links available to Secunia VIM customers