Host access rules using "permit=" and "deny=" configurations behave unpredictably if the CIDR notation "/0" is used. Depending on the system's behavior, this may act as desired, but in other cases it might not, thereby allowing access from hosts that should be denied.
Note that even if an unauthorized host is allowed access due to this exploit, authentication measures still in place would prevent further unauthorized access. Note also that there is a workaround for this problem, which is to use the dotted-decimal format "/0.0.0.0" instead of CIDR notation. The bug does not exist when using this format. In addition, this format is what is used in Asterisk's sample configuration files.
