full-disclosure - [SecuriWeb 2006.1] directory traversal in Asterisk@...e and ARI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <44484E61.1030003@securiweb.net>
Date: Fri Apr 21 04:20:22 2006
From: fharvey at securiweb.net (François Harvey)
Subject: [SecuriWeb 2006.1] directory traversal in
	Asterisk@...e and ARI

ID     :              2006.1
Product :          ARI (Asterisk Recording Interface)
                        http://www.littlejohnconsulting.com/?q=node/11
                        Asterisk@...e Distribution
                        http://asteriskathome.sourceforge.net/
Affected product : <= 0.7.15 (Asterisk@...e 2.6 and lower)
Class :              Access to protected information, directory traversal
Remote :          yes
Author :           Francois Harvey <fharvey at securiweb dot net>
Published date :   2006-04-20 (Initial Vendor contact 2006-03-06)
Reference URL :  
http://www.securiweb.net/wiki/Ressources/AvisDeSecurite/2006.1
Solution :         Use the last ARI version or use asterisk@...e 2.8

Two vulnerabilities was found in the ARI package included in the  
asterisk@...e Distribution. These vulnerabilities allow a user to listen 
voicemail from any other users and and to disclose configuration password.

Vulnerability 1
---------------

The config file is in a public directory and not protected by default

Exploit : http://<asterisk>/recordings/includes/main.conf

This should list all the configuration of ARI. With asterisk password, 
db password, admin password.

Vulnerability 2
---------------

A directory traversal/file retreival exist in the ARI web interface.
This script allow a user to download any mp3/wav/gsm on the system. No 
authentification is needed, this can be used to listen voicemail from 
another user.

Exploit : 
http://<asterisk>/recordings/misc/audio.php?recording=/var/spool/asterisk/voicemail/default/<mailbox>/INBOX/msg<messageid>.wav

This flaw can also be used to verify the presence of a file on the server
Cannot use file: xxx <-- file exist bot not the good extension
404 File not found! <--- file doesn't exist

Patch
------
Both asterisk@...e and ARI released fixes

Author
-------
Francois Harvey <fharvey at securiweb dot net>
SecuriWeb inc | www.securiweb.net