PT-2006-6873 · Sangoma · Freepbx

Published 2006-12-04 · Updated 2011-03-08 · CVE-2006-6244

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions freePBX versions prior to 2.2.0rc1

Description The issue allows attackers to execute arbitrary commands via shell metacharacters in the CALLERID(name) or CALLERID(number) variables.

Recommendations For versions prior to 2.2.0rc1, update to version 2.2.0rc1 or later to resolve the issue. As a temporary workaround, consider restricting input for the CALLERID(name) and CALLERID(number) variables to prevent the use of shell metacharacters.

Fix

Related Identifiers

CVE-2006-6244

Affected Products

Freepbx

References · 6

• http://secunia.com/advisories/23124 · Vendor Advisory
• http://sourceforge.net/project/shownotes.php?group_id=121515&release_id=467129 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-6244 · Security Note
• http://securityfocus.com/bid/21359 · Patch
• http://freepbx.org/trac/changeset/2076 · Note
• http://vupen.com/english/advisories/2006/3019 · Note