PT-2007-3532 · Sangoma · Freepbx+1

Publicado 2007-04-24 · Atualizado 2017-07-29 · CVE-2007-2191

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions freePBX versions 2.2.x

Description The issue allows remote attackers to inject arbitrary web script or HTML via certain SIP protocol fields, including the From, To, Call-ID, and User-Agent fields. These fields are stored in /var/log/asterisk/full and displayed by admin/modules/logfiles/asterisk-full-log.php.

Recommendations For freePBX version 2.2.x, consider restricting access to the asterisk-full-log.php file until a patch is available. As a temporary workaround, avoid using the From, To, Call-ID, and User-Agent fields in the SIP protocol to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-2191

Produtos afetados

Asterisk

Freepbx

Referências · 9

• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053882.html · Exploit
• 🔥 https://exploit-db.com/exploits/29873 · Exploit
• http://securityreason.com/securityalert/2627 · Nota
• http://vupen.com/english/advisories/2007/1535 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2191 · Nota de Segurança
• http://securityfocus.com/bid/23575 · Nota
• http://secunia.com/advisories/24935 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33772 · Nota
• http://osvdb.org/35315 · Nota