Digium · Asterisk Digiumphones · CVE-2012-4737
**Name of the Vulnerable Software and Affected Versions**
Asterisk Open Source versions 1.8.x through 1.8.15.0
Asterisk Open Source version 10.x through 10.7.0
Certified Asterisk versions 1.8.11 through 1.8.11-cert6
Asterisk Digiumphones versions 10.x.x-digiumphones through 10.7.0-digiumphones
Asterisk Business Edition C.3.x through C.3.7.5
**Description**
The issue allows remote authenticated users to bypass intended outbound-call restrictions by leveraging the availability of peer credentials, due to the lack of ACL rule enforcement during certain uses of these credentials.
**Recommendations**
For Asterisk Open Source versions 1.8.x through 1.8.15.0, update to version 1.8.15.1 or later.
For Asterisk Open Source version 10.x through 10.7.0, update to version 10.7.1 or later.
For Certified Asterisk versions 1.8.11 through 1.8.11-cert6, update to version 1.8.11-cert7 or later.
For Asterisk Digiumphones versions 10.x.x-digiumphones through 10.7.0-digiumphones, update to version 10.7.1-digiumphones or later.
For Asterisk Business Edition C.3.x through C.3.7.5, update to version C.3.7.6 or later.