Asterisk Insecure Permissions Vulnerability Allowing Remote Code Execution in Version 22

An insecure permissions vulnerability has been identified in Asterisk version 22. This vulnerability allows remote attackers to execute arbitrary code by exploiting the action_createconfig function. The issue arises from unrestricted permissions that enable the creation of configuration files, which can lead to excessive consumption of system resources.

Impact

Exploitation of this vulnerability could result in arbitrary code execution on the affected system. Additionally, the vulnerability allows for unrestricted creation of configuration files, which could exhaust disk space and deplete system resources.