You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Corey Farrell 4c4e7303a8 AST-2017-006: Fix app_minivm application MinivmNotify command injection ... An admin can configure app_minivm with an externnotify program to be run when a voicemail is received. The app_minivm application MinivmNotify uses ast_safe_system() for this purpose which is vulnerable to command injection since the Caller-ID name and number values given to externnotify can come from an external untrusted source. * Add ast_safe_execvp() function. This gives modules the ability to run external commands with greater safety compared to ast_safe_system(). Specifically when some parameters are filled by untrusted sources the new function does not allow malicious input to break argument encoding. This may be of particular concern where CALLERID(name) or CALLERID(num) may be used as a parameter to a script run by ast_safe_system() which could potentially allow arbitrary command execution. * Changed app_minivm.c:run_externnotify() to use the new ast_safe_execvp() instead of ast_safe_system() to avoid command injection. * Document code injection potential from untrusted data sources for other shell commands that are under user control. ASTERISK-27103 Change-Id: I7552472247a84cde24e1358aaf64af160107aef1		8 years ago
..
Makefile	Merged revisions 207647 via svnmerge from	16 years ago
func_aes.c	Fix many issues from the NULL_RETURNS Coverity report	13 years ago
func_audiohookinherit.c	func_audiohookinherit: Document some missed sources.	13 years ago
func_base64.c	Merged revisions 328247 via svnmerge from	14 years ago
func_blacklist.c	Opaquify ast_channel structs and lists	13 years ago
func_callcompletion.c	Merged revisions 328247 via svnmerge from	14 years ago
func_callerid.c	Add private representation of caller, connected and redirecting party ids.	13 years ago
func_cdr.c	Coverity Report: Fix issues for error type UNINIT in Core supported modules	13 years ago
func_channel.c	Clean up documentation	12 years ago
func_config.c	Merged revisions 328247 via svnmerge from	14 years ago
func_curl.c	Multiple revisions 431297-431298	10 years ago
func_cut.c	Clean up and ensure proper usage of alloca()	13 years ago
func_db.c	AST-2014-018 - func_db: DB Dialplan function permission escalation via AMI.	11 years ago
func_devstate.c	Prevent exhaustion of system resources through exploitation of event cache	13 years ago
func_dialgroup.c	Fix incorrect usages of ast_realloc().	12 years ago
func_dialplan.c	Enable macros in 1.8 to find the next highest "h" extension in a context, like in 1.4.	13 years ago
func_enum.c	Allow ENUM query functions to report lookup errors	14 years ago
func_env.c	BuildSystem: Fix a few issues hightlighted by gcc 6.x	9 years ago
func_extstate.c	Merged revisions 328247 via svnmerge from	14 years ago
func_frame_trace.c	Add missing commit from 11.2-cert	11 years ago
func_global.c	Check result of ast_var_assign() calls for memory allocation failure.	12 years ago
func_groupcount.c	Avoid cppcheck warnings; removing unused vars and a bit of cleanup.	13 years ago
func_hangupcause.c	Make the name of the "HangupCauseClear" application consistent	13 years ago
func_iconv.c	Merged revisions 328247 via svnmerge from	14 years ago
func_jitterbuffer.c	Refactor ast_timer_ack to return an error and handle the error in timer users	13 years ago
func_lock.c	security: Inhibit execution of privilege escalating functions	12 years ago
func_logic.c	Clean up and ensure proper usage of alloca()	13 years ago
func_math.c	Remove annoying unconditional debug message from INC/DEC functions.	13 years ago
func_md5.c	Merged revisions 328247 via svnmerge from	14 years ago
func_module.c	Merged revisions 328247 via svnmerge from	14 years ago
func_odbc.c	Fix misuses of asprintf throughout the code.	13 years ago
func_pitchshift.c	Add missing commit from 11.2-cert	11 years ago
func_presencestate.c	PRESENCE_STATE: Provide better documentation for the 'e' option.	12 years ago
func_rand.c	Merged revisions 328247 via svnmerge from	14 years ago
func_realtime.c	security: Inhibit execution of privilege escalating functions	12 years ago
func_sha1.c	Merged revisions 328247 via svnmerge from	14 years ago
func_shell.c	AST-2017-006: Fix app_minivm application MinivmNotify command injection	8 years ago
func_speex.c	Resolve FORWARD_NULL static analysis warnings	13 years ago
func_sprintf.c	Merged revisions 328247 via svnmerge from	14 years ago
func_srv.c	Merged revisions 328247 via svnmerge from	14 years ago
func_strings.c	Check result of ast_var_assign() calls for memory allocation failure (2).	12 years ago
func_sysinfo.c	Multiple revisions 361403,361412	13 years ago
func_timeout.c	verbosity: Fix performance of console verbose messages.	11 years ago
func_uri.c	Merged revisions 328247 via svnmerge from	14 years ago
func_version.c	Fix documentation for ${VERSION(ASTERISK_VERSION_NUM)}.	13 years ago
func_vmcount.c	Merged revisions 328247 via svnmerge from	14 years ago
func_volume.c	Minor spelling fix to the VOLUME documentation.	13 years ago