what you don't know can hurt you

Asterisk Project Security Advisory - AST-2012-004

Asterisk Project Security Advisory - AST-2012-004
Posted Apr 23, 2012
Authored by Jonathan Rose | Site asterisk.org

Asterisk Project Security Advisory - A user of the Asterisk Manager Interface can bypass a security check and execute shell commands when they lack permission to do so. Under normal conditions, a user should only be able to run shell commands if that user has System class authorization. Users could bypass this restriction by using the MixMonitor application with the originate action or by using either the GetVar or Status manager actions in combination with the SHELL and EVAL functions. The patch adds checks in each affected action to verify if a user has System class authorization. If the user does not have those authorizations, Asterisk rejects the action if it detects the use of any functions or applications that run system commands.

tags | advisory, shell
MD5 | 409cfec2b992f13790527da55bc20c35

Asterisk Project Security Advisory - AST-2012-004

Change Mirror Download
               Asterisk Project Security Advisory - AST-2012-004

Product Asterisk
Summary Asterisk Manager User Unauthorized Shell Access
Nature of Advisory Permission Escalation
Susceptibility Remote Authenticated Sessions
Severity Minor
Exploits Known No
Reported On February 23, 2011
Reported By David Woolley
Posted On April 23, 2012
Last Updated On April 23, 2012
Advisory Contact Jonathan Rose < jrose AT digium DOT com >
CVE Name

Description A user of the Asterisk Manager Interface can bypass a
security check and execute shell commands when they lack
permission to do so. Under normal conditions, a user should
only be able to run shell commands if that user has System
class authorization. Users could bypass this restriction by
using the MixMonitor application with the originate action
or by using either the GetVar or Status manager actions in
combination with the SHELL and EVAL functions. The patch
adds checks in each affected action to verify if a user has
System class authorization. If the user does not have those
authorizations, Asterisk rejects the action if it detects
the use of any functions or applications that run system
commands.

Resolution Asterisk now performs checks against manager commands that
cause these behaviors for each of the affected actions.

Affected Versions
Product Release Series
Asterisk Open Source 1.6.2.x All versions
Asterisk Open Source 1.8.x All versions
Asterisk Open Source 10.x All versions
Asterisk Business Edition C.3.x All versions

Corrected In
Product Release
Asterisk Open Source 1.6.2.24, 1.8.11.1, 10.3.1
Asterisk Business Edition C.3.7.4

Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2012-004-1.6.2.diff v1.6.2
http://downloads.asterisk.org/pub/security/AST-2012-004-1.8.diff v1.8
http://downloads.asterisk.org/pub/security/AST-2012-004-10.diff v10

Links https://issues.asterisk.org/jira/browse/ASTERISK-17465

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2012-004.pdf and
http://downloads.digium.com/pub/security/AST-2012-004.html

Revision History
Date Editor Revisions Made
04/23/2012 Jonathan Rose Initial Release

Asterisk Project Security Advisory - AST-2012-004
Copyright (c) 2012 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    34 Files
  • 2
    Jul 2nd
    15 Files
  • 3
    Jul 3rd
    9 Files
  • 4
    Jul 4th
    8 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    3 Files
  • 7
    Jul 7th
    1 Files
  • 8
    Jul 8th
    15 Files
  • 9
    Jul 9th
    15 Files
  • 10
    Jul 10th
    20 Files
  • 11
    Jul 11th
    17 Files
  • 12
    Jul 12th
    16 Files
  • 13
    Jul 13th
    2 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    20 Files
  • 16
    Jul 16th
    27 Files
  • 17
    Jul 17th
    7 Files
  • 18
    Jul 18th
    5 Files
  • 19
    Jul 19th
    12 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close