PT-2006-6873 · Sangoma · Freepbx

Publicado 2006-12-04 · Atualizado 2011-03-08 · CVE-2006-6244

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions freePBX versions prior to 2.2.0rc1

Description The issue allows attackers to execute arbitrary commands via shell metacharacters in the CALLERID(name) or CALLERID(number) variables.

Recommendations For versions prior to 2.2.0rc1, update to version 2.2.0rc1 or later to resolve the issue. As a temporary workaround, consider restricting input for the CALLERID(name) and CALLERID(number) variables to prevent the use of shell metacharacters.

Correção

Identificadores relacionados

CVE-2006-6244

Produtos afetados

Freepbx

Referências · 6

• http://freepbx.org/trac/changeset/2076 · Nota
• http://secunia.com/advisories/23124 · Aviso do Fabricante
• http://sourceforge.net/project/shownotes.php?group_id=121515&release_id=467129 · Correção
• http://vupen.com/english/advisories/2006/3019 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6244 · Nota de Segurança
• http://securityfocus.com/bid/21359 · Correção