exploit the possibilities

Asterisk Project Security Advisory - AST-2012-004

Asterisk Project Security Advisory - AST-2012-004
Posted Apr 23, 2012
Authored by Jonathan Rose | Site asterisk.org

Asterisk Project Security Advisory - A user of the Asterisk Manager Interface can bypass a security check and execute shell commands when they lack permission to do so. Under normal conditions, a user should only be able to run shell commands if that user has System class authorization. Users could bypass this restriction by using the MixMonitor application with the originate action or by using either the GetVar or Status manager actions in combination with the SHELL and EVAL functions. The patch adds checks in each affected action to verify if a user has System class authorization. If the user does not have those authorizations, Asterisk rejects the action if it detects the use of any functions or applications that run system commands.

tags | advisory, shell
MD5 | 409cfec2b992f13790527da55bc20c35

Asterisk Project Security Advisory - AST-2012-004

Change Mirror Download
               Asterisk Project Security Advisory - AST-2012-004

Product Asterisk
Summary Asterisk Manager User Unauthorized Shell Access
Nature of Advisory Permission Escalation
Susceptibility Remote Authenticated Sessions
Severity Minor
Exploits Known No
Reported On February 23, 2011
Reported By David Woolley
Posted On April 23, 2012
Last Updated On April 23, 2012
Advisory Contact Jonathan Rose < jrose AT digium DOT com >
CVE Name

Description A user of the Asterisk Manager Interface can bypass a
security check and execute shell commands when they lack
permission to do so. Under normal conditions, a user should
only be able to run shell commands if that user has System
class authorization. Users could bypass this restriction by
using the MixMonitor application with the originate action
or by using either the GetVar or Status manager actions in
combination with the SHELL and EVAL functions. The patch
adds checks in each affected action to verify if a user has
System class authorization. If the user does not have those
authorizations, Asterisk rejects the action if it detects
the use of any functions or applications that run system
commands.

Resolution Asterisk now performs checks against manager commands that
cause these behaviors for each of the affected actions.

Affected Versions
Product Release Series
Asterisk Open Source 1.6.2.x All versions
Asterisk Open Source 1.8.x All versions
Asterisk Open Source 10.x All versions
Asterisk Business Edition C.3.x All versions

Corrected In
Product Release
Asterisk Open Source 1.6.2.24, 1.8.11.1, 10.3.1
Asterisk Business Edition C.3.7.4

Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2012-004-1.6.2.diff v1.6.2
http://downloads.asterisk.org/pub/security/AST-2012-004-1.8.diff v1.8
http://downloads.asterisk.org/pub/security/AST-2012-004-10.diff v10

Links https://issues.asterisk.org/jira/browse/ASTERISK-17465

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2012-004.pdf and
http://downloads.digium.com/pub/security/AST-2012-004.html

Revision History
Date Editor Revisions Made
04/23/2012 Jonathan Rose Initial Release

Asterisk Project Security Advisory - AST-2012-004
Copyright (c) 2012 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

October 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    24 Files
  • 2
    Oct 2nd
    15 Files
  • 3
    Oct 3rd
    7 Files
  • 4
    Oct 4th
    4 Files
  • 5
    Oct 5th
    10 Files
  • 6
    Oct 6th
    1 Files
  • 7
    Oct 7th
    21 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    5 Files
  • 10
    Oct 10th
    20 Files
  • 11
    Oct 11th
    17 Files
  • 12
    Oct 12th
    4 Files
  • 13
    Oct 13th
    4 Files
  • 14
    Oct 14th
    15 Files
  • 15
    Oct 15th
    19 Files
  • 16
    Oct 16th
    25 Files
  • 17
    Oct 17th
    17 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close