-
- Downloads
MixMonitor: Add class authorization requirements to MixMonitor AMI commands
MixMonitor AMI commands StartMixMonitor and StopMixMonitor lacked class authorization. StopMixMonitor now requires that the manager user either have the call or system class authorization. StartMixMonitor is a slightly larger issue since it can execute shell commands if the right arguments are passed into it, and we consider this a permission escalation. A security release will be issued for problem this shortly. ASTERISK-23609 #close Reported by: Corey Farrell git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@415825 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Loading
Please register or sign in to comment