mirror of
https://github.com/asterisk/asterisk.git
synced 2025-10-29 23:39:35 +00:00
Compare commits
10 Commits
certified/
...
1.8.15.1
| Author | SHA1 | Date | |
|---|---|---|---|
|
3617be9d6f | ||
|
|
94e9851040 | ||
|
|
9ef91e2a82 | ||
|
|
7f4361bf9c | ||
|
|
bc448fab84 | ||
|
|
74f504ee1e | ||
|
|
3b69ca9d9c | ||
|
|
1e8c2db8f9 | ||
|
|
60c89f482e | ||
|
|
9622e36d23 |
3
.lastclean
Normal file
3
.lastclean
Normal file
@@ -0,0 +1,3 @@
|
||||
39
|
||||
|
||||
|
||||
@@ -23,6 +23,9 @@ Sections
|
||||
* Reducing Pattern Match Typos:
|
||||
Using the 'same' prefix, or using Goto()
|
||||
|
||||
* Manager Class Authorizations:
|
||||
Recognizing potential issues with certain classes of authorization
|
||||
|
||||
----------------
|
||||
Additional Links
|
||||
----------------
|
||||
@@ -293,3 +296,51 @@ same => n,Hangup()
|
||||
exten => error,1,Verbose(2,Unable to lookup technology or device for extension)
|
||||
same => n,Playback(silence/1&num-not-in-db)
|
||||
same => n,Hangup()
|
||||
|
||||
|
||||
============================
|
||||
Manager Class Authorizations
|
||||
============================
|
||||
|
||||
Manager accounts have associated class authorizations that define what actions
|
||||
and events that account can execute/receive. In order to run Asterisk commands
|
||||
or dialplan applications that affect the system Asterisk executes on, the
|
||||
"system" class authorization should be set on the account.
|
||||
|
||||
However, Manager commands that originate new calls into the Asterisk dialplan
|
||||
have the potential to alter or affect the system as well, even though the
|
||||
class authorization for origination commands is "originate". Take, for example,
|
||||
the Originate manager command:
|
||||
|
||||
Action: Originate
|
||||
Channel: SIP/foo
|
||||
Exten: s
|
||||
Context: default
|
||||
Priority: 1
|
||||
Application: System
|
||||
Data: echo hello world!
|
||||
|
||||
This manager command will attempt to execute an Asterisk application, System,
|
||||
which is normally associated with the "system" class authorication. While some
|
||||
checks have been put into Asterisk to take this into account, certain dialplan
|
||||
configurations and/or clever manipulation of the Originate manager action can
|
||||
circumvent these checks. For example, take the following dialplan:
|
||||
|
||||
exten => s,1,Verbose(Incoming call)
|
||||
same => n,MixMonitor(foo.wav,,${EXEC_COMMAND})
|
||||
same => n,Dial(SIP/bar)
|
||||
same => n,Hangup()
|
||||
|
||||
Whatever has been defined in the variable EXEC_COMMAND will be executed after
|
||||
MixMonitor has finished recording the call. The dialplan writer may have
|
||||
intended that this variable to be set by some other location in the dialplan;
|
||||
however, the Manager action Originate allows for channel variables to be set by
|
||||
the account initiating the new call. This could allow the Originate action to
|
||||
execute some command on the system by setting the EXEC_COMMAND dialplan variable
|
||||
in the Variable: header.
|
||||
|
||||
In general, you should treat the Manager class authorization "originate" the
|
||||
same as the class authorization "system". Good system configuration, such as
|
||||
not running Asterisk as root, can prevent serious problems from arising when
|
||||
allowing external connections to originate calls into Asterisk.
|
||||
|
||||
|
||||
63
asterisk-1.8.15.1-summary.html
Normal file
63
asterisk-1.8.15.1-summary.html
Normal file
@@ -0,0 +1,63 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /><title>Release Summary - asterisk-1.8.15.1</title></head>
|
||||
<body>
|
||||
<h1 align="center"><a name="top">Release Summary</a></h1>
|
||||
<h3 align="center">asterisk-1.8.15.1</h3>
|
||||
<h3 align="center">Date: 2012-08-30</h3>
|
||||
<h3 align="center"><asteriskteam@digium.com></h3>
|
||||
<hr/>
|
||||
<h2 align="center">Table of Contents</h2>
|
||||
<ol>
|
||||
<li><a href="#summary">Summary</a></li>
|
||||
<li><a href="#contributors">Contributors</a></li>
|
||||
<li><a href="#commits">Other Changes</a></li>
|
||||
<li><a href="#diffstat">Diffstat</a></li>
|
||||
</ol>
|
||||
<hr/>
|
||||
<a name="summary"><h2 align="center">Summary</h2></a>
|
||||
<center><a href="#top">[Back to Top]</a></center><br/><p>This release has been made to address one or more security vulnerabilities that have been identified. A security advisory document has been published for each vulnerability that includes additional information. Users of versions of Asterisk that are affected are strongly encouraged to review the advisories and determine what action they should take to protect their systems from these issues.</p>
|
||||
<p>Security Advisories: <a href="http://downloads.asterisk.org/pub/security/AST-2012-012.html">AST-2012-012</a>, <a href="http://downloads.asterisk.org/pub/security/AST-2012-013.html">AST-2012-013</a></p>
|
||||
<p>The data in this summary reflects changes that have been made since the previous release, asterisk-1.8.15.0.</p>
|
||||
<hr/>
|
||||
<a name="contributors"><h2 align="center">Contributors</h2></a>
|
||||
<center><a href="#top">[Back to Top]</a></center><br/><p>This table lists the people who have submitted code, those that have tested patches, as well as those that reported issues on the issue tracker that were resolved in this release. For coders, the number is how many of their patches (of any size) were committed into this release. For testers, the number is the number of times their name was listed as assisting with testing a patch. Finally, for reporters, the number is the number of issues that they reported that were closed by commits that went into this release.</p>
|
||||
<table width="100%" border="0">
|
||||
<tr>
|
||||
<td width="33%"><h3>Coders</h3></td>
|
||||
<td width="33%"><h3>Testers</h3></td>
|
||||
<td width="33%"><h3>Reporters</h3></td>
|
||||
</tr>
|
||||
<tr valign="top">
|
||||
<td>
|
||||
2 bebuild<br/>
|
||||
</td>
|
||||
<td>
|
||||
</td>
|
||||
<td>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
<hr/>
|
||||
<a name="commits"><h2 align="center">Commits Not Associated with an Issue</h2></a>
|
||||
<center><a href="#top">[Back to Top]</a></center><br/><p>This is a list of all changes that went into this release that did not directly close an issue from the issue tracker. The commits may have been marked as being related to an issue. If that is the case, the issue numbers are listed here, as well.</p>
|
||||
<table width="100%" border="1">
|
||||
<tr><td><b>Revision</b></td><td><b>Author</b></td><td><b>Summary</b></td><td><b>Issues Referenced</b></td></tr><tr><td><a href="http://svn.digium.com/view/asterisk/tags/1.8.15.1?view=revision&revision=372053">372053</a></td><td>bebuild</td><td>Create 1.8.15.1</td>
|
||||
<td></td></tr><tr><td><a href="http://svn.digium.com/view/asterisk/tags/1.8.15.1?view=revision&revision=372058">372058</a></td><td>bebuild</td><td>Commit fixes for AST-2012-012, AST-2012-013</td>
|
||||
<td></td></tr></table>
|
||||
<hr/>
|
||||
<a name="diffstat"><h2 align="center">Diffstat Results</h2></a>
|
||||
<center><a href="#top">[Back to Top]</a></center><br/><p>This is a summary of the changes to the source code that went into this release that was generated using the diffstat utility.</p>
|
||||
<pre>
|
||||
.version | 2
|
||||
ChangeLog | 10
|
||||
README-SERIOUSLY.bestpractices.txt | 51 +++
|
||||
asterisk-1.8.15.0-summary.html | 382 ----------------------------
|
||||
asterisk-1.8.15.0-summary.txt | 491 -------------------------------------
|
||||
channels/chan_iax2.c | 11
|
||||
main/manager.c | 1
|
||||
7 files changed, 69 insertions(+), 879 deletions(-)
|
||||
</pre><br/>
|
||||
<hr/>
|
||||
</body>
|
||||
</html>
|
||||
92
asterisk-1.8.15.1-summary.txt
Normal file
92
asterisk-1.8.15.1-summary.txt
Normal file
@@ -0,0 +1,92 @@
|
||||
Release Summary
|
||||
|
||||
asterisk-1.8.15.1
|
||||
|
||||
Date: 2012-08-30
|
||||
|
||||
<asteriskteam@digium.com>
|
||||
|
||||
----------------------------------------------------------------------
|
||||
|
||||
Table of Contents
|
||||
|
||||
1. Summary
|
||||
2. Contributors
|
||||
3. Other Changes
|
||||
4. Diffstat
|
||||
|
||||
----------------------------------------------------------------------
|
||||
|
||||
Summary
|
||||
|
||||
[Back to Top]
|
||||
|
||||
This release has been made to address one or more security vulnerabilities
|
||||
that have been identified. A security advisory document has been published
|
||||
for each vulnerability that includes additional information. Users of
|
||||
versions of Asterisk that are affected are strongly encouraged to review
|
||||
the advisories and determine what action they should take to protect their
|
||||
systems from these issues.
|
||||
|
||||
Security Advisories: AST-2012-012, AST-2012-013
|
||||
|
||||
The data in this summary reflects changes that have been made since the
|
||||
previous release, asterisk-1.8.15.0.
|
||||
|
||||
----------------------------------------------------------------------
|
||||
|
||||
Contributors
|
||||
|
||||
[Back to Top]
|
||||
|
||||
This table lists the people who have submitted code, those that have
|
||||
tested patches, as well as those that reported issues on the issue tracker
|
||||
that were resolved in this release. For coders, the number is how many of
|
||||
their patches (of any size) were committed into this release. For testers,
|
||||
the number is the number of times their name was listed as assisting with
|
||||
testing a patch. Finally, for reporters, the number is the number of
|
||||
issues that they reported that were closed by commits that went into this
|
||||
release.
|
||||
|
||||
Coders Testers Reporters
|
||||
2 bebuild
|
||||
|
||||
----------------------------------------------------------------------
|
||||
|
||||
Commits Not Associated with an Issue
|
||||
|
||||
[Back to Top]
|
||||
|
||||
This is a list of all changes that went into this release that did not
|
||||
directly close an issue from the issue tracker. The commits may have been
|
||||
marked as being related to an issue. If that is the case, the issue
|
||||
numbers are listed here, as well.
|
||||
|
||||
+------------------------------------------------------------------------+
|
||||
| Revision | Author | Summary | Issues Referenced |
|
||||
|----------+---------+-------------------------------+-------------------|
|
||||
| 372053 | bebuild | Create 1.8.15.1 | |
|
||||
|----------+---------+-------------------------------+-------------------|
|
||||
| 372058 | bebuild | Commit fixes for | |
|
||||
| | | AST-2012-012, AST-2012-013 | |
|
||||
+------------------------------------------------------------------------+
|
||||
|
||||
----------------------------------------------------------------------
|
||||
|
||||
Diffstat Results
|
||||
|
||||
[Back to Top]
|
||||
|
||||
This is a summary of the changes to the source code that went into this
|
||||
release that was generated using the diffstat utility.
|
||||
|
||||
.version | 2
|
||||
ChangeLog | 10
|
||||
README-SERIOUSLY.bestpractices.txt | 51 +++
|
||||
asterisk-1.8.15.0-summary.html | 382 ----------------------------
|
||||
asterisk-1.8.15.0-summary.txt | 491 -------------------------------------
|
||||
channels/chan_iax2.c | 11
|
||||
main/manager.c | 1
|
||||
7 files changed, 69 insertions(+), 879 deletions(-)
|
||||
|
||||
----------------------------------------------------------------------
|
||||
@@ -7618,10 +7618,10 @@ static int check_access(int callno, struct sockaddr_in *sin, struct iax_ies *ies
|
||||
i = ao2_iterator_init(users, 0);
|
||||
while ((user = ao2_iterator_next(&i))) {
|
||||
if ((ast_strlen_zero(iaxs[callno]->username) || /* No username specified */
|
||||
!strcmp(iaxs[callno]->username, user->name)) /* Or this username specified */
|
||||
&& ast_apply_ha(user->ha, &addr) /* Access is permitted from this IP */
|
||||
!strcmp(iaxs[callno]->username, user->name)) /* Or this username specified */
|
||||
&& ast_apply_ha(user->ha, &addr) == AST_SENSE_ALLOW /* Access is permitted from this IP */
|
||||
&& (ast_strlen_zero(iaxs[callno]->context) || /* No context specified */
|
||||
apply_context(user->contexts, iaxs[callno]->context))) { /* Context is permitted */
|
||||
apply_context(user->contexts, iaxs[callno]->context))) { /* Context is permitted */
|
||||
if (!ast_strlen_zero(iaxs[callno]->username)) {
|
||||
/* Exact match, stop right now. */
|
||||
if (best)
|
||||
@@ -7677,8 +7677,9 @@ static int check_access(int callno, struct sockaddr_in *sin, struct iax_ies *ies
|
||||
user = best;
|
||||
if (!user && !ast_strlen_zero(iaxs[callno]->username)) {
|
||||
user = realtime_user(iaxs[callno]->username, sin);
|
||||
if (user && !ast_strlen_zero(iaxs[callno]->context) && /* No context specified */
|
||||
!apply_context(user->contexts, iaxs[callno]->context)) { /* Context is permitted */
|
||||
if (user && (ast_apply_ha(user->ha, &addr) == AST_SENSE_DENY /* Access is denied from this IP */
|
||||
|| (!ast_strlen_zero(iaxs[callno]->context) && /* No context specified */
|
||||
!apply_context(user->contexts, iaxs[callno]->context)))) { /* Context is permitted */
|
||||
user = user_unref(user);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -4083,6 +4083,7 @@ static int action_originate(struct mansession *s, const struct message *m)
|
||||
strcasestr(app, "agi") || /* AGI(/bin/rm,-rf /)
|
||||
EAGI(/bin/rm,-rf /) */
|
||||
strcasestr(app, "mixmonitor") || /* MixMonitor(blah,,rm -rf) */
|
||||
strcasestr(app, "externalivr") || /* ExternalIVR(rm -rf) */
|
||||
(strstr(appdata, "SHELL") && (bad_appdata = 1)) || /* NoOp(${SHELL(rm -rf /)}) */
|
||||
(strstr(appdata, "EVAL") && (bad_appdata = 1)) /* NoOp(${EVAL(${some_var_containing_SHELL})}) */
|
||||
)) {
|
||||
|
||||
Reference in New Issue
Block a user