mirror of https://github.com/asterisk/asterisk
MixMonitor AMI commands StartMixMonitor and StopMixMonitor lacked class authorization. StopMixMonitor now requires that the manager user either have the call or system class authorization. StartMixMonitor is a slightly larger issue since it can execute shell commands if the right arguments are passed into it, and we consider this a permission escalation. A security release will be issued for problem this shortly. ASTERISK-23609 #close Reported by: Corey Farrell ........ Merged revisions 415837 from http://svn.asterisk.org/svn/asterisk/branches/11 git-svn-id: https://origsvn.digium.com/svn/asterisk/certified/branches/11.6@415842 65c4cc65-6c06-0410-ace0-fbb531ad65f3changes/05/205/1
parent
921c6ff2aa
commit
243ed06c1f
Loading…
Reference in new issue