sysmocom
/
asterisk
11
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
asterisk/apps
History
Corey Farrell 1bf3dfffd7 AST-2017-006: Fix app_minivm application MinivmNotify command injection 
An admin can configure app_minivm with an externnotify program to be run
when a voicemail is received.  The app_minivm application MinivmNotify
uses ast_safe_system() for this purpose which is vulnerable to command
injection since the Caller-ID name and number values given to externnotify
can come from an external untrusted source.

* Add ast_safe_execvp() function.  This gives modules the ability to run
external commands with greater safety compared to ast_safe_system().
Specifically when some parameters are filled by untrusted sources the new
function does not allow malicious input to break argument encoding.  This
may be of particular concern where CALLERID(name) or CALLERID(num) may be
used as a parameter to a script run by ast_safe_system() which could
potentially allow arbitrary command execution.

* Changed app_minivm.c:run_externnotify() to use the new ast_safe_execvp()
instead of ast_safe_system() to avoid command injection.

* Document code injection potential from untrusted data sources for other
shell commands that are under user control.

ASTERISK-27103

Change-Id: I7552472247a84cde24e1358aaf64af160107aef1
 		2017-08-30 18:43:38 +00:00
..
confbridge Merge "app_confbridge: Document sfu video_mode value." 2017-08-23 13:05:35 -05:00
Makefile Fix compile error for old versions of GCC. 2017-08-02 18:10:57 -04:00
app_adsiprog.c modules: change module LOAD_FAILUREs to LOAD_DECLINES 2017-04-12 15:57:21 -06:00
app_agent_pool.c modules: change module LOAD_FAILUREs to LOAD_DECLINES 2017-04-12 15:57:21 -06:00
app_alarmreceiver.c modules: change module LOAD_FAILUREs to LOAD_DECLINES 2017-04-12 15:57:21 -06:00
app_amd.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_authenticate.c modules: change module LOAD_FAILUREs to LOAD_DECLINES 2017-04-12 15:57:21 -06:00
app_bridgeaddchan.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_bridgewait.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_cdr.c modules: change module LOAD_FAILUREs to LOAD_DECLINES 2017-04-12 15:57:21 -06:00
app_celgenuserevent.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_chanisavail.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_channelredirect.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_chanspy.c Fix compiler warnings on Fedora 26 / GCC 7. 2017-08-01 15:42:38 -06:00
app_confbridge.c confbridge: Handle user hangup during name recording 2017-08-29 09:28:11 -05:00
app_controlplayback.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_dahdiras.c modules: change module LOAD_FAILUREs to LOAD_DECLINES 2017-04-12 15:57:21 -06:00
app_db.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_dial.c asterisk: Audit locking of channel when manipulating flags. 2017-05-16 14:25:23 +00:00
app_dictate.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_directed_pickup.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_directory.c realtime: Fix ast_load_realtime_multientry handling 2017-02-21 13:06:29 -06:00
app_disa.c asterisk: Audit locking of channel when manipulating flags. 2017-05-16 14:25:23 +00:00
app_dumpchan.c asterisk: Audit locking of channel when manipulating flags. 2017-05-16 14:25:23 +00:00
app_echo.c apps/app_echo: Only relay a single video source change frame 2016-11-14 17:03:32 -05:00
app_exec.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_externalivr.c asterisk: Audit locking of channel when manipulating flags. 2017-05-16 14:25:23 +00:00
app_fax.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_festival.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_flash.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_followme.c Fix compiler warnings on Fedora 26 / GCC 7. 2017-08-01 15:42:38 -06:00
app_forkcdr.c modules: change module LOAD_FAILUREs to LOAD_DECLINES 2017-04-12 15:57:21 -06:00
app_getcpeid.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_ices.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_image.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_ivrdemo.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_jack.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_macro.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_meetme.c core: Remove 'Data Retrieval API' 2017-07-05 11:25:58 -05:00
app_milliwatt.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_minivm.c AST-2017-006: Fix app_minivm application MinivmNotify command injection 2017-08-30 18:43:38 +00:00
app_mixmonitor.c AST-2017-006: Fix app_minivm application MinivmNotify command injection 2017-08-30 18:43:38 +00:00
app_morsecode.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_mp3.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_nbscat.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_originate.c manager: Restore Originate failure behavior from Asterisk 11 2017-02-10 18:04:41 -05:00
app_osplookup.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_page.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_playback.c app_playback.c: Use the timezonename parameter 2017-07-12 23:22:56 +02:00
app_playtones.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_privacy.c app_privacy: remove unused header asterisk/image.h 2017-08-02 17:08:48 -04:00
app_queue.c app_queue: Evaluate realtime queues when running dialplan functions 2017-08-24 09:44:27 -05:00
app_read.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_readexten.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_record.c app_record: Resolve some absolute vs. relative filename bugs 2017-08-25 12:27:12 -05:00
app_saycounted.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_sayunixtime.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_senddtmf.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_sendtext.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_setcallerid.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_skel.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_sms.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_softhangup.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_speech_utils.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_stack.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_stasis.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_statsd.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_stream_echo.c app_stream_echo: misc bug fixes 2017-06-30 10:57:34 -05:00
app_system.c AST-2017-006: Fix app_minivm application MinivmNotify command injection 2017-08-30 18:43:38 +00:00
app_talkdetect.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_test.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_transfer.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_url.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_userevent.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_verbose.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_voicemail.c voicemail: Fix various abuses of mkstemp 2017-08-25 16:08:55 -05:00
app_voicemail.exports.in Remove some symbol exports that got missed in the removal of global symbols. 2012-06-15 15:33:41 +00:00
app_waitforring.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_waitforsilence.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_waituntil.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_while.c Remove ASTERISK_REGISTER_FILE. 2016-10-27 09:53:55 -04:00
app_zapateller.c modules: change module LOAD_FAILUREs to LOAD_DECLINES 2017-04-12 15:57:21 -06:00
enter.h remove extraneous svn:executable properties 2005-11-29 18:24:39 +00:00
leave.h remove extraneous svn:executable properties 2005-11-29 18:24:39 +00:00