summaryrefslogtreecommitdiff
path: root/configs
diff options
context:
space:
mode:
authorCorey Farrell <git@cfware.com>2017-07-01 20:24:27 -0400
committerJoshua Colp <jcolp@digium.com>2017-08-30 18:41:25 +0000
commit04ee3eb774271abb06eee9a11762f561458af183 (patch)
treef1f5858435dbf9191185f05281eec812f92c4af4 /configs
parent844f70f3011c6c812a2bd52b2bd3c4a6c5dba17f (diff)
AST-2017-006: Fix app_minivm application MinivmNotify command injection
An admin can configure app_minivm with an externnotify program to be run when a voicemail is received. The app_minivm application MinivmNotify uses ast_safe_system() for this purpose which is vulnerable to command injection since the Caller-ID name and number values given to externnotify can come from an external untrusted source. * Add ast_safe_execvp() function. This gives modules the ability to run external commands with greater safety compared to ast_safe_system(). Specifically when some parameters are filled by untrusted sources the new function does not allow malicious input to break argument encoding. This may be of particular concern where CALLERID(name) or CALLERID(num) may be used as a parameter to a script run by ast_safe_system() which could potentially allow arbitrary command execution. * Changed app_minivm.c:run_externnotify() to use the new ast_safe_execvp() instead of ast_safe_system() to avoid command injection. * Document code injection potential from untrusted data sources for other shell commands that are under user control. ASTERISK-27103 Change-Id: I7552472247a84cde24e1358aaf64af160107aef1
Diffstat (limited to 'configs')
-rw-r--r--configs/samples/minivm.conf.sample2
1 files changed, 1 insertions, 1 deletions
diff --git a/configs/samples/minivm.conf.sample b/configs/samples/minivm.conf.sample
index 2df3449d1..79fdbb0e2 100644
--- a/configs/samples/minivm.conf.sample
+++ b/configs/samples/minivm.conf.sample
@@ -51,7 +51,7 @@ silencethreshold=128
; If you need to have an external program, i.e. /usr/bin/myapp called when a
; voicemail is received by the server. The arguments are
;
-; <app> <username@domain> <callerid-number> <callerid-name>
+; <app> <username@domain> <callerid-name> <callerid-number>
;
;externnotify=/usr/bin/myapp
; The character set for voicemail messages can be specified here