kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-11-16 14:58:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

security: Inhibit execution of privilege escalating functions

Browse Source 
This patch allows individual dialplan functions to be marked as
'dangerous', to inhibit their execution from external sources.

A 'dangerous' function is one which results in a privilege escalation.
For example, if one were to read the channel variable SHELL(rm -rf /)
Bad Things(TM) could happen; even if the external source has only read
permissions.

Execution from external sources may be enabled by setting
'live_dangerously' to 'yes' in the [options] section of asterisk.conf.
Although doing so is not recommended.

Also, the ABI was changed to something more reasonable, since Asterisk
12 does not yet have a public release.

(closes issue ASTERISK-22905)
Review: http://reviewboard.digium.internal/r/432/
........

Merged revisions 403913 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 403917 from http://svn.asterisk.org/svn/asterisk/branches/11
........

Merged revisions 403959 from http://svn.asterisk.org/svn/asterisk/branches/12


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@403960 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
David M. Lee
2013-12-16 19:11:51 +00:00
parent 00dcee2a64
commit 744556c01d
12 changed files with 418 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
main/asterisk.c
View File

@@ -3332,6 +3332,8 @@ static void ast_readconfig(void)
unsigned int dbdir:1;
unsigned int keydir:1;
} found = { 0, 0 };
/* Default to true for backward compatibility */
int live_dangerously = 1;
/* Set default value */
option_dtmfminduration = AST_MIN_DTMF_DURATION;
@@ -3565,8 +3567,11 @@ static void ast_readconfig(void)
v->value);
ast_clear_flag(&ast_options, AST_OPT_FLAG_STDEXTEN_MACRO);
}
} else if (!strcasecmp(v->name, "live_dangerously")) {
live_dangerously = ast_true(v->value);
}
}
pbx_live_dangerously(live_dangerously);
for (v = ast_variable_browse(cfg, "compat"); v; v = v->next) {
float version;
if (sscanf(v->value, "%30f", &version) != 1) {