CVE-2007-6170 - Secunia Advisories - Vulnerability Information

CVE Reference: CVE-2007-6170
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2007-6170

Description: SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments.

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/38765 SUSE http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html ST 1019020 SAID Secunia Advisory: SA29242 Secunia Advisory: SA29782 Secunia Advisory: SA27827 Secunia Advisory: SA27892 GENTOO http://security.gentoo.org/glsa/glsa-200804-13.xml DEBIAN http://www.debian.org/security/2007/dsa-1417 CONFIRM http://downloads.digium.com/pub/security/AST-2007-026.html BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/484388/100/0/threaded BID 26647

Return to the previous page.