CVE:CVE-2005-3559
CNNVD:CNNVD-200511-177
Asterisk是一款PBX系统的软件，运行在Linux系统上，支持使用SIP、IAX、H323协议进行IP通话。
Asterisk 1.0.9 直到 1.2.0-beta1 版本中，vmail.cgi 存在目录遍历漏洞，这会允许远程攻击者在目录参数中加入".."(参数中包含'..')来访问WAV文件。
solution:Upgrade digium asterisk to a higher version than 0.1.0,0.1.1,0.1.2,0.1.3,0.1.4,0.1.5,0.1.6,0.1.7,0.1.8,0.1.9,0.1.10,0.1.11,0.1.12,0.2.0,0.3.0,0.4.0,0.5.0,0.7.0,0.7.1,0.7.2,1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,1.0.9,1.0_rc1,1.0_rc2,1.2.0_beta1,and avoid the version 0.1.0,0.1.1,0.1.2,0.1.3,0.1.4,0.1.5,0.1.6,0.1.7,0.1.8,0.1.9,0.1.10,0.1.11,0.1.12,0.2.0,0.3.0,0.4.0,0.5.0,0.7.0,0.7.1,0.7.2,1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,1.0.9,1.0_rc1,1.0_rc2,1.2.0_beta1