The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
res_config_pgsql SQL Injection Issue
------------------------------------------------------------------------
SUMMARY
Input buffers were not properly escaped when providing lookup data to the
Postgres Realtime Engine. An attacker could potentially compromise the
administrative database containing users' usernames and passwords used for
SIP authentication, among other things.
This module is not active by default and must be configured for use by the
administrator. Default installations of Asterisk are not affected.
DETAILS
Vulnerable Systems:
* Asterisk Open Source version 1.4.14 and previous
* Asterisk Business Edition version C.1.0-beta5 and previous
Immune Systems:
* Asterisk Open Source version 1.4.15
* Asterisk Business Edition version C.1.0-beta6
Workaround:
Convert your installation to use res_config_odbc with the PgsqlODBC
driver. This module provides similar functionality but is not vulnerable.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6171>
CVE-2007-6171
ADDITIONAL INFORMATION
The information has been provided by <mailto:p_christ@hol.gr> P.
Chisteas.
The original article can be found at:
<http://downloads.digium.com/pub/security/AST-2007-025.html>
http://downloads.digium.com/pub/security/AST-2007-025.html
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
