CVE-2014-8412

Vulnerability

The vulnerability exists in Asterisk's access control list (ACL) implementation used by VoIP channel drivers, DUNDi, and the Asterisk Manager Interface (AMI). When processing incoming IP packets, Asterisk only compares the packet's address family to the IP address family of the first entry in the ACL list. If the packet's source IP is of a different address family (e.g., IPv6 versus IPv4) than the first ACL rule, all ACL rules are bypassed. This affects Asterisk Open Source versions 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1, as well as Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 [1].

Exploitation

An attacker can send a crafted IP packet with a source address that does not match the address family of the first ACL rule. No authentication is required to trigger the ACL bypass, though the specific module (e.g., VoIP channel) may still enforce additional authentication. The attacker simply needs network access to the target Asterisk server [1].

Impact

Successful exploitation allows the attacker to bypass ACL restrictions entirely, potentially gaining unauthorized access to sensitive services. Since the packet may still require protocol-specific authentication, the impact varies; however, the ACL bypass itself could enable further attacks or information gathering. The core issue is a violation of the intended access control policy [1].

Mitigation

The fix is included in Asterisk Open Source versions 1.8.32.1, 11.14.1, 12.7.1, and 13.0.1, and Certified Asterisk versions 1.8.28-cert3 and 11.6-cert8. Users should upgrade to these versions or later. For those unable to upgrade, ensuring all ACL rules use the same address family can avoid the bug, but this is not a complete workaround. No other mitigations are documented in the advisory [1].