directory traversal in Asterisk@Home and ARI

2006.04.21
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-Other


Ogólna skala CVSS: 5/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Brak
Wpływ na dostępność: Brak

ID : 2006.1 Product : ARI (Asterisk Recording Interface) http://www.littlejohnconsulting.com/?q=node/11 Asterisk@home Distribution http://asteriskathome.sourceforge.net/ Affected product : <= 0.7.15 (Asterisk@Home 2.6 and lower) Class : Access to protected information, directory traversal Remote : yes Author : Francois Harvey <fharvey at securiweb dot net> Published date : 2006-04-20 (Initial Vendor contact 2006-03-06) Reference URL : http://www.securiweb.net/wiki/Ressources/AvisDeSecurite/2006.1 Solution : Use the last ARI version or use asterisk@home 2.8 Two vulnerabilities was found in the ARI package included in the asterisk@home Distribution. These vulnerabilities allow a user to listen voicemail from any other users and and to disclose configuration password. Vulnerability 1 --------------- The config file is in a public directory and not protected by default Exploit : http://<asterisk>/recordings/includes/main.conf This should list all the configuration of ARI. With asterisk password, db password, admin password. Vulnerability 2 --------------- A directory traversal/file retreival exist in the ARI web interface. This script allow a user to download any mp3/wav/gsm on the system. No authentification is needed, this can be used to listen voicemail from another user. Exploit : http://<asterisk>/recordings/misc/audio.php?recording=/var/spool/asteris k/voicemail/default/<mailbox>/INBOX/msg<messageid>.wav This flaw can also be used to verify the presence of a file on the server Cannot use file: xxx <-- file exist bot not the good extension 404 File not found! <--- file doesn't exist Patch ------ Both asterisk@home and ARI released fixes Author ------- Francois Harvey <fharvey at securiweb dot net> SecuriWeb inc | www.securiweb.net


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top