PT-2007-7276 · Fonality · Fonality Trixbox

Published 2007-12-18 · Updated 2024-02-14 · CVE-2007-6424

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Fonality Trixbox version 2.0

Description The issue allows remote attackers to execute arbitrary commands via a DNS spoofing attack, as the registry.pl script reads and executes commands from a remote web site without proper validation. This can lead to the disabling of trixbox.

Recommendations For Fonality Trixbox version 2.0, consider restricting access to the registry.pl script until a proper fix is available, and ensure that the environment in which it is running is secure to minimize the risk of DNS spoofing attacks.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-6424

Affected Products

Fonality Trixbox

References · 8

• 🔥 http://superunknown.org/pivot/entry.php?id=15 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6424 · Security Note
• http://trixbox.org/forums/trixbox-forums/open-discussion/trixbox-phones-home · Note
• http://voipsa.org/pipermail/voipsec_voipsa.org/2007-December/002528.html · Note
• http://voipsa.org/pipermail/voipsec_voipsa.org/2007-December/002533.html · Note
• http://voipsa.org/pipermail/voipsec_voipsa.org/2007-December/002522.html · Note
• http://osvdb.org/44136 · Note
• http://voipsa.org/blog/2007/12/17/trixbox-contains-phone-home-code-to-retrieve-arbitrary-commands-to-execute · Note