asterisk

Commit Graph

Author	SHA1	Message	Date
Josh Soref	b9e888418e	configs: Spelling fixes Correct typos of the following word families: password excludes undesirable checksums through screening interpreting database causes initiation member busydetect defined severely throughput recognized counter require indefinitely accounts ASTERISK-29714 Change-Id: Ie8f2a7b274a162dd627ee6a2165f5e8a3876527e	4 years ago
Corey Farrell	1bf3dfffd7	AST-2017-006: Fix app_minivm application MinivmNotify command injection An admin can configure app_minivm with an externnotify program to be run when a voicemail is received. The app_minivm application MinivmNotify uses ast_safe_system() for this purpose which is vulnerable to command injection since the Caller-ID name and number values given to externnotify can come from an external untrusted source. * Add ast_safe_execvp() function. This gives modules the ability to run external commands with greater safety compared to ast_safe_system(). Specifically when some parameters are filled by untrusted sources the new function does not allow malicious input to break argument encoding. This may be of particular concern where CALLERID(name) or CALLERID(num) may be used as a parameter to a script run by ast_safe_system() which could potentially allow arbitrary command execution. * Changed app_minivm.c:run_externnotify() to use the new ast_safe_execvp() instead of ast_safe_system() to avoid command injection. * Document code injection potential from untrusted data sources for other shell commands that are under user control. ASTERISK-27103 Change-Id: I7552472247a84cde24e1358aaf64af160107aef1	8 years ago
Richard Mudgett	4aaa27e532	Sample configs: Eliminate false multiline comment block starts. Change-Id: Ie627def9604ae30abd80754f9e6f09874825aec6	9 years ago
Matthew Jordan	fc0fecb476	configs: Move sample config files into a subdirectory of configs This moves all samples configs from configs/ to configs/samples. This allows for additional sets of sample configuration files to be added in the future. Review: https://reviewboard.asterisk.org/r/3804/ git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@418870 65c4cc65-6c06-0410-ace0-fbb531ad65f3	11 years ago

4 Commits (3c67d08219a8cc8dd55e86ed15dc9bf8dbec3043)