vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2017-14100

N/A
Published: September 2, 2017 at 04:00 PM UTC
Updated: June 17, 2026 at 01:05 AM UTC
2 products affected across 1 vendorAsteriskCertified Asterisk

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 15%

Description

In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command execution is possible. The app_minivm module has an "externnotify" program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source, a crafted caller-id name or number allows an arbitrary shell command injection.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Asterisk· Digium
95%
11.0.011.0.0 beta111.0.0 beta211.0.0 rc111.0.0 rc211.0.111.0.211.1.011.1.0 rc111.1.0 rc211.1.0 rc311.1.111.1.211.10.011.10.0 rc111.10.111.10.1 rc111.10.211.11.011.11.0 rc111.12.011.12.0 rc111.12.111.13.011.13.0 rc111.13.111.14.011.14.0 rc111.14.0 rc211.14.111.14.211.15.0 rc111.15.0 rc211.15.111.16.0 rc111.17.0 rc111.17.111.18.011.18.0 rc111.19.0 rc111.2.0 rc111.2.111.2.211.20.0 rc111.21.0 rc111.21.0 rc211.21.111.21.211.22.011.22.0 rc111.23.011.23.0 rc111.23.111.24.011.24.111.25.011.25.111.4.0 rc411.6.011.6.0 rc111.6.0 rc211.6.111.7.011.7.0 rc111.7.0 rc211.8.011.8.0 rc111.8.0 rc211.8.0 rc311.8.111.9.011.9.0 rc111.9.0 rc211.9.0 rc313.0.013.0.0 beta113.0.0 beta213.0.0 beta313.0.113.0.213.1.013.1.0 rc113.1.0 rc213.1.113.10.013.10.0 rc113.11.013.11.113.11.213.1213.12.013.12.113.12.213.1313.13.013.13.113.14.013.14.0 rc113.14.0 rc213.14.113.15.013.15.0 rc113.15.0 rc213.15.0 rc313.15.113.16.013.16.0 rc113.16.0 rc213.17.013.17.0 rc113.2.013.2.0 rc113.2.113.3.0 rc113.3.213.4.013.4.0 rc113.5.013.5.0 rc113.6.0 rc113.7.0 rc113.7.0 rc213.7.113.7.213.8.013.8.0 rc113.8.113.8.213.9.013.9.114.014.0.014.0.0 beta114.0.0 beta214.0.0 rc114.0.0 rc214.0.114.0.214.0114.0214.114.1.014.1.114.1.214.214.2.014.2.114.3.014.3.0 rc114.3.0 rc214.3.114.4.014.4.0 rc114.4.0 rc214.4.0 rc314.4.114.5.014.5.0 rc114.5.0 rc214.6.014.6.0 rc1
Certified Asterisk· Digium
95%
11.6 cert111.6 cert1011.6 cert1111.6 cert1211.6 cert1311.6 cert1411.6 cert14_rc111.6 cert14_rc211.6 cert1511.6 cert1611.6 cert1_rc111.6 cert1_rc211.6 cert211.6 cert311.6 cert411.6 cert511.6 cert611.6 cert711.6 cert811.6 cert913.13 cert113.13 cert1_rc113.13 cert1_rc213.13 cert1_rc313.13 cert1_rc413.13 cert213.13 cert313.13 cert4

References (6)

x_refsource_CONFIRMVendor Advisory
Source: [email protected]
http://downloads.asterisk.org/pub/security/AST-2017-006.html
Vendor Advisoryx_refsource_DEBIAN
Source: [email protected]
http://www.debian.org/security/2017/dsa-3964
VDB Entryx_refsource_SECTRACKThird Party Advisory
Source: [email protected]
http://www.securitytracker.com/id/1039252
x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
Source: [email protected]
https://bugs.debian.org/873908
x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
Source: [email protected]
https://issues.asterisk.org/jira/browse/ASTERISK-27103
Vendor Advisoryx_refsource_GENTOO
Source: [email protected]
https://security.gentoo.org/glsa/201710-29

CVSS

7.5HIGH[email protected]
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
PARTIAL
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-78

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card