sysmocom/asterisk
11
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
asterisk/configs/samples
History
Corey Farrell 1bf3dfffd7 AST-2017-006: Fix app_minivm application MinivmNotify command injection 
An admin can configure app_minivm with an externnotify program to be run
when a voicemail is received.  The app_minivm application MinivmNotify
uses ast_safe_system() for this purpose which is vulnerable to command
injection since the Caller-ID name and number values given to externnotify
can come from an external untrusted source.

* Add ast_safe_execvp() function.  This gives modules the ability to run
external commands with greater safety compared to ast_safe_system().
Specifically when some parameters are filled by untrusted sources the new
function does not allow malicious input to break argument encoding.  This
may be of particular concern where CALLERID(name) or CALLERID(num) may be
used as a parameter to a script run by ast_safe_system() which could
potentially allow arbitrary command execution.

* Changed app_minivm.c:run_externnotify() to use the new ast_safe_execvp()
instead of ast_safe_system() to avoid command injection.

* Document code injection potential from untrusted data sources for other
shell commands that are under user control.

ASTERISK-27103

Change-Id: I7552472247a84cde24e1358aaf64af160107aef1
2017-08-30 18:43:38 +00:00
..
acl.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
adsi.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
agents.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
alarmreceiver.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
alsa.conf.sample Sample configs: Eliminate false multiline comment block starts. 2016-09-02 13:01:13 -05:00
amd.conf.sample app_amd: Correct maximum_number_of_words functionality & documentation 2015-12-21 16:02:09 -08:00
app_mysql.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
app_skel.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
ari.conf.sample res_ari: Add support for channel variables in ARI events. 2016-11-14 13:51:56 -05:00
ast_debug_tools.conf.sample debug_utilities: Create ast_loggrabber 2017-01-20 11:20:22 -06:00
asterisk.adsi configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
asterisk.conf.sample rtp_engine: allocate RTP dynamic payloads per session 2017-03-22 15:43:33 -05:00
calendar.conf.sample res_calendar: Add support for fetching calendars when reloading 2016-10-10 10:43:53 -05:00
ccss.conf.sample Sample configs: Eliminate false multiline comment block starts. 2016-09-02 13:01:13 -05:00
cdr.conf.sample cdr: fix mistake spelling of a word for Unanswered. 2017-06-19 12:28:18 -04:00
cdr_adaptive_odbc.conf.sample cdr_adaptive_odbc: Add ability to set character for quoted identifiers. 2015-05-05 04:38:33 -04:00
cdr_custom.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
cdr_manager.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
cdr_mysql.conf.sample cdr_mysql: fix UTC support 2016-09-15 13:16:04 +03:00
cdr_odbc.conf.sample cdr/cdr_odbc.c: Added to record new columns add on CDR 1.8 Asterisk Version 2015-04-27 09:38:15 -05:00
cdr_pgsql.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
cdr_sqlite3_custom.conf.sample Sqlite3: make busy_timeout configurable. 2017-05-25 10:02:42 +02:00
cdr_syslog.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
cdr_tds.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
cel.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
cel_custom.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
cel_odbc.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
cel_pgsql.conf.sample cel_pgsql: Add support for setting schema 2015-05-05 07:59:12 -04:00
cel_sqlite3_custom.conf.sample Sqlite3: make busy_timeout configurable. 2017-05-25 10:02:42 +02:00
cel_tds.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
chan_dahdi.conf.sample chan_dahdi: remove by_name support 2016-10-27 23:46:00 +03:00
chan_mobile.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
cli.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
cli_aliases.conf.sample Sample Configurations: make 'pjsip reload' reload all reloadable pjsip modules 2014-10-17 22:45:27 +00:00
cli_permissions.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
codecs.conf.sample codecs.conf.sample: Fix max_bandwidth speling error 2017-06-11 12:08:05 -05:00
confbridge.conf.sample app_confbridge: Document sfu video_mode value. 2017-08-22 11:23:45 -05:00
config_test.conf.sample core: Add PARSE_TIMELEN support to ast_parse_arg and ACO. 2017-07-13 11:44:14 -04:00
console.conf.sample Sample configs: Eliminate false multiline comment block starts. 2016-09-02 13:01:13 -05:00
dbsep.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
dnsmgr.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
dsp.conf.sample dsp.c: Correct DTMF twist dsp.conf documentation. 2016-07-26 17:46:25 -05:00
dundi.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
enum.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
extconfig.conf.sample pjsip: Add Alembic for PUBLISH support. 2017-04-07 08:44:49 -05:00
extensions.ael.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
extensions.conf.sample samples: Undo removal of include from canonicalize-app-names commit. 2017-04-08 03:16:26 -05:00
extensions.lua.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
extensions_minivm.conf.sample Git Conversion: Switch Non-C files to ASTERISK_REGISTER_FILE. 2015-04-29 01:02:10 -04:00
features.conf.sample Update version number in features.conf.sample 2016-01-16 20:02:43 +00:00
festival.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
followme.conf.sample followme: allow disabling callee prompt 2016-05-26 08:00:09 +03:00
func_odbc.conf.sample func_odbc: single database connection should be optional 2016-05-20 13:46:03 -04:00
hep.conf.sample res_hep_rtcp: Provide chan_sip Call-ID for RTCP messages. 2017-05-09 05:38:59 -05:00
http.conf.sample AST-2016-001 http: Provide greater control of TLS and set modern defaults. 2016-02-03 15:10:16 -06:00
iax.conf.sample channels/chan_iax2: Add a configuration parameter for call token expiration 2015-04-10 12:23:42 +00:00
iaxprov.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
indications.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
logger.conf.sample logger: Added logger_queue_limit to the configuration options. 2017-05-08 16:49:13 -05:00
manager.conf.sample manager: Clarify that dialplan manipulation actions are under system class. 2016-08-15 07:34:29 -05:00
meetme.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
mgcp.conf.sample Sample configs: Eliminate false multiline comment block starts. 2016-09-02 13:01:13 -05:00
minivm.conf.sample AST-2017-006: Fix app_minivm application MinivmNotify command injection 2017-08-30 18:43:38 +00:00
misdn.conf.sample Sample configs: Eliminate false multiline comment block starts. 2016-09-02 13:01:13 -05:00
modules.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
motif.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
musiconhold.conf.sample res_musiconhold: Add kill_escalation_delay, kill_method to class 2017-07-11 14:43:41 -06:00
muted.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
ooh323.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
osp.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
oss.conf.sample Sample configs: Eliminate false multiline comment block starts. 2016-09-02 13:01:13 -05:00
phone.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
phoneprov.conf.sample res_phoneprov: Refactor phoneprov to allow pluggable config providers 2014-10-09 17:46:23 +00:00
pjproject.conf.sample PJPROJECT logging: Made easier to get available logging levels. 2016-11-30 13:11:48 -06:00
pjsip.conf.sample res_pjsip: Add "webrtc" configuration option 2017-07-13 18:19:35 -05:00
pjsip_notify.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
pjsip_wizard.conf.sample res_pjsip_config_wizard: Add 2 new parameters to help with proxy config 2017-03-28 15:51:21 -06:00
queuerules.conf.sample app_queue: Add QUEUE_RAISE_PENALTY feature 2017-05-22 09:20:02 -03:00
queues.conf.sample app_queue: Add announce-position-only-up option 2017-08-01 15:42:37 -06:00
res_config_mysql.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
res_config_sqlite.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
res_config_sqlite3.conf.sample Sqlite3: make busy_timeout configurable. 2017-05-25 10:02:42 +02:00
res_corosync.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
res_curl.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
res_fax.conf.sample res_fax: Add T.38 negotiation timeout option 2015-01-09 14:53:09 +00:00
res_ldap.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
res_odbc.conf.sample res_odbc: Remove deprecated settings from sample configuration file 2017-02-02 11:28:05 -06:00
res_parking.conf.sample res_parking: Update parking documentation for dynamic parking lots. 2016-03-25 18:25:47 -05:00
res_pgsql.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
res_pktccops.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
res_snmp.conf.sample Sample configs: Eliminate false multiline comment block starts. 2016-09-02 13:01:13 -05:00
res_stun_monitor.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
resolver_unbound.conf.sample dns: Add core DNS API + unit tests and res_resolver_unbound module + unit tests. 2015-03-25 12:32:26 +00:00
rtp.conf.sample res_rtp_asterisk.c: Add stun_blacklist option 2017-04-11 12:58:35 -05:00
say.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
sip.conf.sample chan_sip: Add rtcp-mux support 2017-03-17 07:36:06 -06:00
sip_notify.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
skinny.conf.sample Sample configs: Eliminate false multiline comment block starts. 2016-09-02 13:01:13 -05:00
sla.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
smdi.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
sorcery.conf.sample pjsip: Add Alembic for PUBLISH support. 2017-04-07 08:44:49 -05:00
ss7.timers.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
stasis.conf.sample main/stasis: Allow subscriptions to use a threadpool for message delivery 2014-12-01 17:59:21 +00:00
statsd.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
telcordia-1.adsi configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
test_sorcery.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
udptl.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
unistim.conf.sample Sample configs: Eliminate false multiline comment block starts. 2016-09-02 13:01:13 -05:00
users.conf.sample configs: Move sample config files into a subdirectory of configs 2014-07-17 21:17:28 +00:00
voicemail.conf.sample app_voicemail: IMAP connection control 2017-06-22 12:23:27 -05:00
vpb.conf.sample Sample configs: Eliminate false multiline comment block starts. 2016-09-02 13:01:13 -05:00
xmpp.conf.sample res_xmpp: Google OAuth 2.0 protocol support for XMPP / Motif 2017-08-15 06:09:52 -05:00