You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Corey Farrell e918cb2b1e AST-2017-006: Fix app_minivm application MinivmNotify command injection ... An admin can configure app_minivm with an externnotify program to be run when a voicemail is received. The app_minivm application MinivmNotify uses ast_safe_system() for this purpose which is vulnerable to command injection since the Caller-ID name and number values given to externnotify can come from an external untrusted source. * Add ast_safe_execvp() function. This gives modules the ability to run external commands with greater safety compared to ast_safe_system(). Specifically when some parameters are filled by untrusted sources the new function does not allow malicious input to break argument encoding. This may be of particular concern where CALLERID(name) or CALLERID(num) may be used as a parameter to a script run by ast_safe_system() which could potentially allow arbitrary command execution. * Changed app_minivm.c:run_externnotify() to use the new ast_safe_execvp() instead of ast_safe_system() to avoid command injection. * Document code injection potential from untrusted data sources for other shell commands that are under user control. ASTERISK-27103 Change-Id: I7552472247a84cde24e1358aaf64af160107aef1		8 years ago
..
confbridge	app_confbridge: Default the template option to a compatible default profile.	10 years ago
Makefile	Makefile: Remove coverage files on 'make clean'	10 years ago
app_adsiprog.c	Fix printf problems with high ascii characters after r413586 (1.8).	11 years ago
app_alarmreceiver.c	Fix typo's (retrieve, specified, address).	10 years ago
app_amd.c	app_amd: Correct documentation to reflect functionality	9 years ago
app_authenticate.c	ast_channel opaquification of pointers and integral types	13 years ago
app_cdr.c	ast_channel opaquification of pointers and integral types	13 years ago
app_celgenuserevent.c	Remove unnecessary channel module references.	13 years ago
app_chanisavail.c	docs: Fix a few typo's in app docs (more then, resourse).	10 years ago
app_channelredirect.c	Finalize ast_channel opaquification	13 years ago
app_chanspy.c	app_chanspy: Fix occasional deadlock with ChanSpy and Local channels.	9 years ago
app_confbridge.c	app_confbridge.c: Update CONFBRIDGE and CONFBRIDGE_INFO documentation.	9 years ago
app_controlplayback.c	Merged revisions 328247 via svnmerge from	14 years ago
app_dahdibarge.c	Opaquify ast_channel typedefs, fd arrays, and softhangup flag	13 years ago
app_dahdiras.c	Opaquify ast_channel typedefs, fd arrays, and softhangup flag	13 years ago
app_db.c	Don't throw a spurious error when using DBdeltree	12 years ago
app_dial.c	app_dial: Immediately exit dial if the caller is already hung up.	9 years ago
app_dictate.c	apps/app_dictate: Fix typo in attribution	10 years ago
app_directed_pickup.c	Named call pickup groups. Fixes, missing functionality, and improvements.	13 years ago
app_directory.c	Fix coverity UNUSED_VALUE findings in core support level files	13 years ago
app_disa.c	Coverity Report: Fix issues for error type UNINIT in Core supported modules	13 years ago
app_dumpchan.c	Allow Asterisk to compile under GCC 4.10	11 years ago
app_echo.c	Prevent Echo() from relaying control, null, and modem frames	13 years ago
app_exec.c	Merged revisions 328247 via svnmerge from	14 years ago
app_externalivr.c	Audit ast_sockaddr_resolve() usage for memory leaks.	10 years ago
app_fax.c	Opaquify ast_channel structs and lists	13 years ago
app_festival.c	Allow Asterisk to compile under GCC 4.10	11 years ago
app_flash.c	Opaquify ast_channel typedefs, fd arrays, and softhangup flag	13 years ago
app_followme.c	followme: initialize all config items on reload	9 years ago
app_forkcdr.c	app_forkcdr: ForkCDR v option does not keep CDR variables for subsequent records	11 years ago
app_getcpeid.c	Fix printf problems with high ascii characters after r413586 (1.8).	11 years ago
app_ices.c	Add missing newlines to CLI logging	13 years ago
app_image.c	Merged revisions 328247 via svnmerge from	14 years ago
app_ivrdemo.c	ast_channel opaquification of pointers and integral types	13 years ago
app_jack.c	Fix dialplan function NULL channel safety issues	11 years ago
app_macro.c	app_macro: Consider '~~s~~' as a macro start extension.	9 years ago
app_meetme.c	app_meetme: Set default value for audio_buffers.	10 years ago
app_milliwatt.c	Replace GNU old-style field designator extensions to fix clang warnings	13 years ago
app_minivm.c	AST-2017-006: Fix app_minivm application MinivmNotify command injection	8 years ago
app_mixmonitor.c	AST-2017-006: Fix app_minivm application MinivmNotify command injection	8 years ago
app_morsecode.c	Merged revisions 336717 via svnmerge from	14 years ago
app_mp3.c	app_mp3: Use correct buffer size and the same sample rate as the channel	9 years ago
app_nbscat.c	Opaquification for ast_format structs in struct ast_channel	13 years ago
app_originate.c	Allow support for early media on AMI originates and call files.	13 years ago
app_osplookup.c	Fix printf problems with high ascii characters after r413586 (1.8).	11 years ago
app_page.c	docs: Fix a few typo's in app docs (more then, resourse).	10 years ago
app_parkandannounce.c	Make ParkAndAnnounce return to priority + 1 when return context is not defined	12 years ago
app_playback.c	Check result of ast_var_assign() calls for memory allocation failure.	12 years ago
app_playtones.c	ast_channel opaquification of pointers and integral types	13 years ago
app_privacy.c	Opaquify ast_channel structs and lists	13 years ago
app_queue.c	app_queue: Added initialization for "context" parameter	9 years ago
app_read.c	ast_channel opaquification of pointers and integral types	13 years ago
app_readexten.c	Opaquify ast_channel structs and lists	13 years ago
app_readfile.c	Merged revisions 328247 via svnmerge from	14 years ago
app_record.c	app_record: RECORDED_FILE variable not being populated	10 years ago
app_saycounted.c	Merged revisions 336717 via svnmerge from	14 years ago
app_sayunixtime.c	ast_channel opaquification of pointers and integral types	13 years ago
app_senddtmf.c	Fix SendDTMF crash and channel reference leak using channel name parameter.	13 years ago
app_sendtext.c	ast_channel opaquification of pointers and integral types	13 years ago
app_setcallerid.c	Opaquify ast_channel structs and lists	13 years ago
app_skel.c	Fix minor reference leaks in app_skel and TEST_FRAMEWORK	11 years ago
app_sms.c	Fix printf problems with high ascii characters after r413586 (1.8).	11 years ago
app_softhangup.c	ast_channel opaquification of pointers and integral types	13 years ago
app_speech_utils.c	datastores: Audit ast_channel_datastore_remove usage.	11 years ago
app_stack.c	Allow Asterisk to compile under GCC 4.10	11 years ago
app_system.c	AST-2017-006: Fix app_minivm application MinivmNotify command injection	8 years ago
app_talkdetect.c	Finalize ast_channel opaquification	13 years ago
app_test.c	Opaquification for ast_format structs in struct ast_channel	13 years ago
app_transfer.c	Documentation: doc fixes across various parts of the code for ASTERISK issues 23061,23028,23046,23027	11 years ago
app_url.c	Merged revisions 339777 via svnmerge from	14 years ago
app_userevent.c	Add AMI event documentation	13 years ago
app_verbose.c	Allow Asterisk to compile under GCC 4.10	11 years ago
app_voicemail.c	app_voicemail: Clear voice mailbox in MailboxExists and MAILBOX_EXISTS.	9 years ago
app_voicemail.exports.in	Remove some symbol exports that got missed in the removal of global symbols.	13 years ago
app_waitforring.c	Multiple revisions 375993-375994	13 years ago
app_waitforsilence.c	Opaquification for ast_format structs in struct ast_channel	13 years ago
app_waituntil.c	Merged revisions 328247 via svnmerge from	14 years ago
app_while.c	Clean up and ensure proper usage of alloca()	13 years ago
app_zapateller.c	Opaquify ast_channel structs and lists	13 years ago
enter.h	…
leave.h	…