Asterisk Input Validation Flaw in cdr_pgsql Lets Remote Users Inject SQL Commands
|
|
SecurityTracker Alert ID: 1019020
|
|
SecurityTracker URL: http://securitytracker.com/id?1019020
|
|
CVE Reference: CVE-2007-6170
(Links to External Site)
|
Date: Nov 30 2007
|
Impact: Disclosure of system information, Disclosure of user information, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 1.4.15
|
Description: A vulnerability was reported in Asterisk. A remote user can inject SQL commands.
The cdr_pgsql module does not properly validate user-supplied input. A remote user can supply a specially crafted ANI or DNIS parameter
value to execute SQL commands on the underlying administrative database, which contains usernames and passwords.
The vendor was
notified on November 29, 2007.
Tilghman Lesher reported this vulnerability.
|
Impact: A remote user can execute SQL commands on the underlying database.
|
Solution: The vendor has issued a fixed version (1.4.15).
The Asterisk advisory is available at:
http://www.asterisk.org/node/48432
|
Vendor URL: www.asterisk.org/node/48432 (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 29 Nov 2007 21:18:54 -0500
Subject: Asterisk
|
http://www.asterisk.org/node/48432
CVE-2007-6170
|
|
