CVE-2006-4346

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-08-24 · updated 2026-06-16

Description

Asterisk 1.2.10 supports the use of client-controlled variables to determine filenames in the Record function, which allows remote attackers to (1) execute code via format string specifiers or (2) overwrite files via directory traversals involving unspecified vectors, as demonstrated by the CALLERIDNAME variable.

Affected products

Digium Asterisk: 1.2.10

References

http://labs.musecurity.com/advisories/MU-200608-01.txt
http://secunia.com/advisories/22651
http://securitytracker.com/id?1016742
http://www.gentoo.org/security/en/glsa/glsa-200610-15.xml
http://www.securityfocus.com/archive/1/444322/100/0/threaded
http://www.securityfocus.com/bid/19683
http://www.sineapps.com/news.php?rssid=1448
http://www.vupen.com/english/advisories/2006/3372
https://exchange.xforce.ibmcloud.com/vulnerabilities/28544
https://exchange.xforce.ibmcloud.com/vulnerabilities/28564
http://labs.musecurity.com/advisories/MU-200608-01.txt
http://secunia.com/advisories/22651

Get alerted when CVE-2006-4346 or the next vulnerability affects your stack