kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-12 15:45:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

AST-2017-006: Fix app_minivm application MinivmNotify command injection

Browse Source 
An admin can configure app_minivm with an externnotify program to be run
when a voicemail is received.  The app_minivm application MinivmNotify
uses ast_safe_system() for this purpose which is vulnerable to command
injection since the Caller-ID name and number values given to externnotify
can come from an external untrusted source.

* Add ast_safe_execvp() function.  This gives modules the ability to run
external commands with greater safety compared to ast_safe_system().
Specifically when some parameters are filled by untrusted sources the new
function does not allow malicious input to break argument encoding.  This
may be of particular concern where CALLERID(name) or CALLERID(num) may be
used as a parameter to a script run by ast_safe_system() which could
potentially allow arbitrary command execution.

* Changed app_minivm.c:run_externnotify() to use the new ast_safe_execvp()
instead of ast_safe_system() to avoid command injection.

* Document code injection potential from untrusted data sources for other
shell commands that are under user control.

ASTERISK-27103

Change-Id: I7552472247a84cde24e1358aaf64af160107aef1
This commit is contained in:
Corey Farrell
2017-07-01 20:24:27 -04:00
committed by Joshua Colp
parent 844f70f301
commit 04ee3eb774
9 changed files with 179 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
res/res_monitor.c
View File

@@ -62,17 +62,17 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
<syntax>
<parameter name="file_format" argsep=":">
<argument name="file_format" required="true">
<para>optional, if not set, defaults to <literal>wav</literal></para>
<para>Optional. If not set, defaults to <literal>wav</literal></para>
</argument>
<argument name="urlbase" />
</parameter>
<parameter name="fname_base">
<para>if set, changes the filename used to the one specified.</para>
<para>If set, changes the filename used to the one specified.</para>
</parameter>
<parameter name="options">
<optionlist>
<option name="m">
<para>when the recording ends mix the two leg files into one and
<para>When the recording ends mix the two leg files into one and
delete the two leg files. If the variable <variable>MONITOR_EXEC</variable>
is set, the application referenced in it will be executed instead of
soxmix/sox and the raw leg files will NOT be deleted automatically.
@@ -83,6 +83,13 @@ ASTERISK_FILE_VERSION(__FILE__, "$Revision$")
will be passed on as additional arguments to <variable>MONITOR_EXEC</variable>.
Both <variable>MONITOR_EXEC</variable> and the Mix flag can be set from the
administrator interface.</para>
<warning><para>Do not use untrusted strings such as
<variable>CALLERID(num)</variable> or <variable>CALLERID(name)</variable>
as part of <variable>MONITOR_EXEC</variable> or
<variable>MONITOR_EXEC_ARGS</variable>. You risk a command injection
attack executing arbitrary commands if the untrusted strings aren't
filtered to remove dangerous characters. See function
<variable>FILTER()</variable>.</para></warning>
</option>
<option name="b">
<para>Don't begin recording unless a call is bridged to another channel.</para>