what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Atstake Security Advisory 03-09-11.1

Atstake Security Advisory 03-09-11.1
Posted Sep 13, 2003
Authored by Atstake, Ollie Whitehouse | Site atstake.com

Atstake Security Advisory A091103-1 - The Asterisk software PBX is vulnerable to a SQL injection attack if a user is able to supply malformed CallerID data.

tags | advisory, sql injection
advisories | CVE-2003-0779
SHA-256 | 5e15bb2ff6724c97a49a179d9a726211e776427e671df463171f1f56c220d1b7

Atstake Security Advisory 03-09-11.1

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


@stake, Inc.
www.atstake.com

Security Advisory

Advisory Name: Asterisk CallerID CDR SQL Injection
Release Date: 09/11/2003
Application: Asterisk
Platform: Linux (x86)
Severity: An attacker is able to obtain remote access to the
database/host via the CallerID string
Authors: Ollie Whitehouse [ollie@atstake.com]
Vendor Status: Informed / CVS Updated 9th of September 2003
CVE Candidate: CAN-2003-0779
Reference: www.atstake.com/research/advisories/2003/a091103-1.txt


Overview:

Asterisk (http://www.asterisk.org/) is a complete PBX (Private
Branch eXchange) in software. It runs on Linux and provides all of the
features you would expect from a PBX and more. Asterisk does voice over IP
with three protocols (SIP, IAX v1 and v2, and H323), and can interoperate
with almost all standards-based telephony equipment using relatively
inexpensive hardware.

Call Detail Records (CDRs) are generated by telephony systems in order
to perform a number of functions such as billing and rating. CDRs contain
a number of fields that identify useful information about the call
including source, destination, and other items such as CallerID. These
can be generated numerous times during the call to indicate the state of
the call as well.

@stake found an issue while conducting a source code review of the CDR
logging functionality. It is possible to perform SQL injection if an
attacker can supply a malformed CallerID string.

The interesting thing to note about this vulnerability is that is can
not only be launched via VoIP protocols, but also through fixed-line
connections (i.e. POTS - Plain Old Telephone System).


Details:

@stake discovered that minimal input validation occurred between CDR
generation and the acceptance of this data as part of the SQL query.

SQL injection is covered in great details in:

i) SQL Injection
http://www.spidynamics.com/papers/SQLInjectionWhitePaper.pdf

ii) Advanced SQL Injection
http://www.ngssoftware.com/papers/advanced_sql_injection.pdf

As a result, it is possible for a remote unauthenticated user to
perform arbitrary database operations.


Recommendation:

@stake notified the author of this particular code on the 17th of
August. The author developed and deployed a patch silently to the CVS
on the 9th of September.

@stake recommends that if you have not deployed a CVS version
since the 9th of September 2003 to immediately do so.


Common Vulnerabilities and Exposures (CVE) Information:

The Common Vulnerabilities and Exposures (CVE) project has assigned
the following names to these issues. These are candidates for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems.

CAN-2003-0779 Asterisk CallerID CDR SQL injection


@stake Vulnerability Reporting Policy:
http://www.atstake.com/research/policy/

@stake Advisory Archive:
http://www.atstake.com/research/advisories/

PGP Key:
http://www.atstake.com/research/pgp_key.asc

@stake is currently seeking application security experts to fill
several consulting positions. Applicants should have strong
application development skills and be able to perform application
security design reviews, code reviews, and application penetration
testing. Please send resumes to jobs@atstake.com.

Copyright 2003 @stake, Inc. All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBP2DXsEe9kNIfAm4yEQJwjwCeIiLUirU+hXo5bOu+72byxKKx5GIAoLxk
SlTyCUqbrBRlJl+k4CScWJOx
=5Vb3
-----END PGP SIGNATURE-----


Login or Register to add favorites

File Archive:

November 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    30 Files
  • 2
    Nov 2nd
    0 Files
  • 3
    Nov 3rd
    0 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    44 Files
  • 6
    Nov 6th
    18 Files
  • 7
    Nov 7th
    9 Files
  • 8
    Nov 8th
    8 Files
  • 9
    Nov 9th
    3 Files
  • 10
    Nov 10th
    0 Files
  • 11
    Nov 11th
    14 Files
  • 12
    Nov 12th
    20 Files
  • 13
    Nov 13th
    63 Files
  • 14
    Nov 14th
    18 Files
  • 15
    Nov 15th
    8 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    18 Files
  • 19
    Nov 19th
    7 Files
  • 20
    Nov 20th
    13 Files
  • 21
    Nov 21st
    6 Files
  • 22
    Nov 22nd
    48 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    60 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    44 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close