Asterisk Project Security Advisory - AST-2007-023
ยฑ-----------------------------------------------------------------------+
| Product | Asterisk-Addons |
|--------------------ยฑ--------------------------------------------------|
| Summary | SQL Injection Vulnerability in cdr_addon_mysql |
|--------------------ยฑ--------------------------------------------------|
| Nature of Advisory | SQL Injection |
|--------------------ยฑ--------------------------------------------------|
| Susceptibility | Remote Unauthenticated Sessions |
|--------------------ยฑ--------------------------------------------------|
| Severity | Minor |
|--------------------ยฑ--------------------------------------------------|
| Exploits Known | Yes |
|--------------------ยฑ--------------------------------------------------|
| Reported On | October 16, 2007 |
|--------------------ยฑ--------------------------------------------------|
| Reported By | Humberto Abdelnur <humberto.abdelnur AT loria DOT |
| | fr> |
|--------------------ยฑ--------------------------------------------------|
| Posted On | October 16, 2007 |
|--------------------ยฑ--------------------------------------------------|
| Last Updated On | October 16, 2007 |
|--------------------ยฑ--------------------------------------------------|
| Advisory Contact | Tilghman Lesher <tlesher AT digium DOT com> |
|--------------------ยฑ--------------------------------------------------|
| CVE Name | CVE-2007-5488 |
ยฑ-----------------------------------------------------------------------+
ยฑ-----------------------------------------------------------------------+
| Description | The source and destination numbers for a given call are |
| | not correctly escaped by the cdr_addon_mysql module when |
| | inserting a record. Therefore, a carefully crafted |
| | destination number sent to an Asterisk system running |
| | cdr_addon_mysql could escape out of a SQL data field and |
| | create another query. This vulnerability is made all the |
| | more severe if a user were using realtime data, since |
| | the data may exist in the same database as the inserted |
| | call detail record, thus creating all sorts of possible |
| | data corruption and invalidation issues. |
ยฑ-----------------------------------------------------------------------+
ยฑ-----------------------------------------------------------------------+
| Resolution | The Asterisk-addons package is not distributed with |
| | Asterisk, nor is it installed by default. The module may |
| | be either disabled or upgraded to fix this issue. |
ยฑ-----------------------------------------------------------------------+
ยฑ-----------------------------------------------------------------------+
Affected Versions |
---|
Product |
----------------------ยฑ------------ยฑ---------------------------------- |
Asterisk Open Source |
----------------------ยฑ------------ยฑ---------------------------------- |
Asterisk Open Source |
----------------------ยฑ------------ยฑ---------------------------------- |
Asterisk Open Source |
----------------------ยฑ------------ยฑ---------------------------------- |
Asterisk Business |
Edition |
----------------------ยฑ------------ยฑ---------------------------------- |
Asterisk Business |
Edition |
----------------------ยฑ------------ยฑ---------------------------------- |
AsteriskNOW |
----------------------ยฑ------------ยฑ---------------------------------- |
Asterisk Appliance |
Developer Kit |
----------------------ยฑ------------ยฑ---------------------------------- |
s800i (Asterisk |
Appliance) |
ยฑ-----------------------------------------------------------------------+ |
ยฑ-----------------------------------------------------------------------+
Corrected In |
---|
Product |
----------------------------------------ยฑ------------------------------ |
Asterisk-Addons |
----------------------------------------ยฑ------------------------------ |
Asterisk-Addons |
----------------------------------------ยฑ------------------------------ |
ยฑ-----------------------------------------------------------------------+ |
ยฑ-----------------------------------------------------------------------+
| Links | |
ยฑ-----------------------------------------------------------------------+
ยฑ-----------------------------------------------------------------------+
| Asterisk Project Security Advisories are posted at |
| http://www.asterisk.org/security. |
| |
| This document may be superseded by later versions; if so, the latest |
| version will be posted at |
| http://downloads.digium.com/pub/security/AST-2007-023.pdf and |
| http://downloads.digium.com/pub/security/AST-2007-023.html. |
ยฑ-----------------------------------------------------------------------+
ยฑ-----------------------------------------------------------------------+
Revision History |
---|
Date |
-----------------ยฑ----------------------ยฑ----------------------------- |
2007-10-16 |
-----------------ยฑ----------------------ยฑ----------------------------- |
2007-10-16 |
ยฑ-----------------------------------------------------------------------+ |
Asterisk Project Security Advisory - 2007-AST-023
Copyright (c) 2007 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.