Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status

Asterisk: Root privilege escalation — GLSA 202006-20

A vulnerability was discovered in Asterisk which may allow local attackers to gain root privileges.

Affected packages

Package net-misc/asterisk on all architectures
Affected versions < 13.32.0-r1
Unaffected versions >= 13.32.0-r1

Background

A Modular Open Source PBX System.

Description

It was discovered that Gentoo’s Asterisk ebuild does not properly set permissions on its data directories. This only affects OpenRC systems, as the flaw was exploitable via the init script.

Impact

A local attacker could escalate privileges.

Workaround

Users should ensure the proper permissions are set as discussed in the referenced bugs. Do not run /etc/init.d/asterisk checkperms.

Resolution

All Asterisk users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-misc/asterisk-13.32.0-r1"

References

Release date
June 15, 2020

Latest revision
June 15, 2020: 1

Severity
high

Exploitable
local

Bugzilla entries