CVE ID:	CVE-2006-4346
Description:	Asterisk 1.2.10 supports the use of client-controlled variables to determine filenames in the Record function, which allows remote attackers to (1) execute code via format string specifiers or (2) overwrite files via directory traversals involving unspecified vectors, as demonstrated by the CALLERIDNAME variable.
Test IDs:	None available
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2006-4346 BugTraq ID: 19683 http://www.securityfocus.com/bid/19683 Bugtraq: 20060825 Multiple Vulnerabilities in Asterisk 1.2.10 (Fixed in 1.2.11) (Google Search) http://www.securityfocus.com/archive/1/444322/100/0/threaded http://www.gentoo.org/security/en/glsa/glsa-200610-15.xml http://labs.musecurity.com/advisories/MU-200608-01.txt http://securitytracker.com/id?1016742 http://secunia.com/advisories/22651 http://www.vupen.com/english/advisories/2006/3372 XForce ISS Database: asterisk-record-code-execution(28544) https://exchange.xforce.ibmcloud.com/vulnerabilities/28544 XForce ISS Database: asterisk-record-directory-traversal(28564) https://exchange.xforce.ibmcloud.com/vulnerabilities/28564