Asterisk vmail.cgi obtain information
| asterisk-vmail-obtain-information (23002) |  Low Risk |
Description:
Asterisk could allow an authenticated attacker to obtain information caused by a vulnerability in the vmail.cgi script. An authenticated attacker could send a specially-crafted URL request to the vmail.cgi script to obtain sensitive information including other user's voicemail recordings.
Platforms Affected:
- Debian, Debian Linux 3.0
- Debian, Debian Linux 3.1
- Digium, Asterisk @ Home 1.5 and prior
- Digium, Asterisk @ Home Beta 2.0Beta4 and prior
- Digium, Asterisk Beta 1.2.0-beta1and prior
- Digium, Asterisk Open Source 1.0.9 and prior
Remedy:
Apply the appropriate patch available from the Asterisk Web site. See References.
For Debian GNU/Linux:
Refer to DSA-1048-1 for patch, upgrade, or suggested workaround information. See References.
Consequences:
Obtain Information
References:
- Asterisk Web site, Asterisk - The Open Source Linux PBX at http://www.asterisk.org/.
- BugTraq Mailing List, Sun Nov 06 2005 - 18:19:19 CST, Asterisk vmail.cgi vulnerability at http://archives.neohapsis.com/archives/bugtraq/2005-11/0089.html.
- BID-15336: Asterisk Voicemail Unauthorized Access Vulnerability
- CVE-2005-3559: Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a .. (dot dot) in the folder parameter.
- DSA-1048: asterisk -- several vulnerabilities
- OSVDB ID: 20577: Asterisk vmail.cgi folder Variable Traversal Arbitrary .wav File Access
- SA17459: Asterisk "folder" Disclosure of Sound Files
- SECTRACK ID: 1015164: Asterisk Web-Voicemail Discloses Voicemail Messages to Remote Authenticated Users
- VUPEN/ADV-2005-2346: Asterisk vmail.cgi Script Remote Directory Traversal Vulnerability
Reported:
Nov 06, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net