Asterisk Security Team
2012-Aug-30 20:45 UTC
[asterisk-announce] AST-2012-012: Asterisk Manager User Unauthorized Shell Access
Asterisk Project Security Advisory - AST-2012-012
Product Asterisk
Summary Asterisk Manager User Unauthorized Shell Access
Nature of Advisory Permission Escalation
Susceptibility Remote Authenticated Sessions
Severity Minor
Exploits Known No
Reported On July 13, 2012
Reported By Zubair Ashraf of IBM X-Force Research
Posted On August 30, 2012
Last Updated On August 30, 2012
Advisory Contact Matt Jordan < mjordan AT digium DOT com >
CVE Name CVE-2012-2186
Description The AMI Originate action can allow a remote user to specify
information that can be used to execute shell commands on
the system hosting Asterisk. This can result in an unwanted
escalation of permissions, as the Originate action, which
requires the "originate" class authorization, can be
used
to perform actions that would typically require the
"system" class authorization. Previous attempts to
prevent
this permission escalation (AST-2011-006, AST-2012-004)
have sought to do so by inspecting the names of
applications and functions passed in with the Originate
action and, if those applications/functions matched a
predefined set of values, rejecting the command if the user
lacked the "system" class authorization. As reported
by IBM
X-Force Research, the "ExternalIVR" application is
not
listed in the predefined set of values. The solution for
this particular vulnerability is to include the
"ExternalIVR" application in the set of defined
applications/functions that require "system" class
authorization.
Unfortunately, the approach of inspecting fields in the
Originate action against known applications/functions has a
significant flaw. The predefined set of values can be
bypassed by creative use of the Originate action or by
certain dialplan configurations, which is beyond the
ability of Asterisk to analyze at run-time. Attempting to
work around these scenarios would result in severely
restricting the applications or functions and prevent their
usage for legitimate means. As such, any additional
security vulnerabilities, where an application/function
that would normally require the "system" class
authorization can be executed by users with the
"originate"
class authorization, will not be addressed. Instead, the
README-SERIOUSLY.bestpractices.txt file has been updated to
reflect that the AMI Originate action can result in
commands requiring the "system" class authorization
to be
executed. Proper system configuration can limit the impact
of such scenarios.
The next release of each version of Asterisk will contain,
in addition to the fix for the "ExternalIVR"
application,
an updated README-SERIOUSLY.bestpractices.txt file.
Resolution Asterisk now checks for the "ExternalIVR" application
when
processing the Originate action.
Additionally, the README-SERIOUSLY.bestpractices.txt file
has been updated. It is highly recommended that, if AMI is
utilized with accounts that have the "originate" class
authorization, Asterisk is run under a defined user that
does not have root permissions. Accounts with the
"originate" class authorization should be treated in a
similar manner to those with the "system" class
authorization.
Affected Versions
Product Release Series
Asterisk Open Source 1.8.x All versions
Asterisk Open Source 10.x All versions
Certified Asterisk 1.8.11 All versions
Asterisk Digiumphones 10.x.x-digiumphones All versions
Asterisk Business Edition C.3.x All versions
Corrected In
Product Release
Asterisk Open Source 1.8.15.1, 10.7.1
Certified Asterisk 1.8.11-cert6
Asterisk Digiumphones 10.7.1-digiumphones
Asterisk Business Edition C.3.7.6
Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2012-012-1.8.diff Asterisk
1.8
http:downloads.asterisk.org/pub/security/AST-2012-012-10.diff Asterisk
10
Links https://issues.asterisk.org/jira/browse/ASTERISK-20132
Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security
This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2012-012.pdf and
http://downloads.digium.com/pub/security/AST-2012-012.html
Revision History
Date Editor Revisions Made
08/27/2012 Matt Jordan Initial version
Asterisk Project Security Advisory - AST-2012-012
Copyright (c) 2012 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.