You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Corey Farrell e918cb2b1e AST-2017-006: Fix app_minivm application MinivmNotify command injection ... An admin can configure app_minivm with an externnotify program to be run when a voicemail is received. The app_minivm application MinivmNotify uses ast_safe_system() for this purpose which is vulnerable to command injection since the Caller-ID name and number values given to externnotify can come from an external untrusted source. * Add ast_safe_execvp() function. This gives modules the ability to run external commands with greater safety compared to ast_safe_system(). Specifically when some parameters are filled by untrusted sources the new function does not allow malicious input to break argument encoding. This may be of particular concern where CALLERID(name) or CALLERID(num) may be used as a parameter to a script run by ast_safe_system() which could potentially allow arbitrary command execution. * Changed app_minivm.c:run_externnotify() to use the new ast_safe_execvp() instead of ast_safe_system() to avoid command injection. * Document code injection potential from untrusted data sources for other shell commands that are under user control. ASTERISK-27103 Change-Id: I7552472247a84cde24e1358aaf64af160107aef1		8 years ago
..
Makefile	…
func_aes.c	func_aes: fix misuse of strlen on binary data	10 years ago
func_audiohookinherit.c	…
func_base64.c	…
func_blacklist.c	…
func_callcompletion.c	…
func_callerid.c	func_callerid: Document that CALLERID(pres) is available.	10 years ago
func_cdr.c	Coverity Report: Fix issues for error type UNINIT in Core supported modules	14 years ago
func_channel.c	…
func_config.c	…
func_curl.c	Unit tests: Use AST_TEST_DEFINE in conditional code only.	10 years ago
func_cut.c	…
func_db.c	…
func_devstate.c	…
func_dialgroup.c	…
func_dialplan.c	…
func_enum.c	…
func_env.c	BuildSystem: Fix a few issues hightlighted by gcc 6.x	10 years ago
func_extstate.c	…
func_frame_trace.c	…
func_global.c	…
func_groupcount.c	…
func_hangupcause.c	…
func_iconv.c	func_iconv: Ensure output strings are properly terminated.	10 years ago
func_jitterbuffer.c	…
func_lock.c	…
func_logic.c	…
func_math.c	clang compiler warnings: Fix sometimes-initialized warning in func_math	11 years ago
func_md5.c	…
func_module.c	…
func_odbc.c	…
func_pitchshift.c	…
func_presencestate.c	func_presencestate: Return "not_set" when no data is set in AstDB	10 years ago
func_rand.c	…
func_realtime.c	…
func_sha1.c	…
func_shell.c	AST-2017-006: Fix app_minivm application MinivmNotify command injection	8 years ago
func_speex.c	…
func_sprintf.c	…
func_srv.c	…
func_strings.c	…
func_sysinfo.c	…
func_timeout.c	…
func_uri.c	…
func_version.c	…
func_vmcount.c	…
func_volume.c	…