Asterisk vmail.cgi obtain information
| asterisk-vmail-obtain-information (23002) |  Low Risk |
Description:
Asterisk could allow an authenticated attacker to obtain information caused by a vulnerability in the vmail.cgi script. An authenticated attacker could send a specially-crafted URL request to the vmail.cgi script to obtain sensitive information including other user's voicemail recordings.
Consequences:
Obtain Information
Remedy:
Apply the appropriate patch available from the Asterisk Web site. See References.
For Debian GNU/Linux:
Refer to DSA-1048-1 for patch, upgrade, or suggested workaround information. See References.
References:
- Asterisk Web site: Asterisk - The Open Source Linux PBX.
- BugTraq Mailing List, Sun Nov 06 2005 - 18:19:19 CST: Asterisk vmail.cgi vulnerability.
- BID-15336: Asterisk Voicemail Unauthorized Access Vulnerability
- CVE-2005-3559: Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a .. (dot dot) in the folder parameter.
- DSA-1048: asterisk -- several vulnerabilities
- OSVDB ID: 20577: Asterisk vmail.cgi folder Variable Traversal Arbitrary .wav File Access
- SA17459: Asterisk "folder" Disclosure of Sound Files
- SECTRACK ID: 1015164: Asterisk Web-Voicemail Discloses Voicemail Messages to Remote Authenticated Users
- VUPEN/ADV-2005-2346: Asterisk vmail.cgi Script Remote Directory Traversal Vulnerability
Platforms Affected:
- Debian Debian Linux 3.0
- Debian Debian Linux 3.1
- Digium Asterisk @ Home 1.5
- Digium Asterisk @ Home Beta 2.0Beta4 and prior
- Digium Asterisk Beta 1.2.0 beta1
- Digium Asterisk Open Source 1.0.9
Reported:
Nov 06, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net