From 243ed06c1f35f84b1cfed3d6f07339817b917cfe Mon Sep 17 00:00:00 2001
From: Jonathan Rose <jrose@digium.com>
Date: Thu, 12 Jun 2014 16:06:51 +0000
Subject: [PATCH] MixMonitor: Add class authorization requirements to
MixMonitor AMI commands
MixMonitor AMI commands StartMixMonitor and StopMixMonitor lacked class
authorization. StopMixMonitor now requires that the manager user either have
the call or system class authorization. StartMixMonitor is a slightly larger
issue since it can execute shell commands if the right arguments are passed
into it, and we consider this a permission escalation. A security release
will be issued for problem this shortly.
ASTERISK-23609 #close
Reported by: Corey Farrell
........
Merged revisions 415837 from http://svn.asterisk.org/svn/asterisk/branches/11
git-svn-id: https://origsvn.digium.com/svn/asterisk/certified/branches/11.6@415842 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---
UPGRADE.txt | 6 ++++++
apps/app_mixmonitor.c | 6 +++---
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/UPGRADE.txt b/UPGRADE.txt
index c824f09091..ecce1955c4 100644
--- a/UPGRADE.txt
+++ b/UPGRADE.txt
@@ -20,6 +20,12 @@
===
===========================================================
+From 11.6-cert1 to 11.6-cert3:
+* MixMonitor AMI actions now require users to have authorization classes.
+ * MixMonitor - system
+ * MixMonitorMute - call or system
+ * StopMixMonitor - call or system
+
From 11.6 to 11.6-cert1:
* Certain dialplan functions have been marked as 'dangerous', and may only be
executed from the dialplan. Execution from extenal sources (AMI's GetVar and
diff --git a/apps/app_mixmonitor.c b/apps/app_mixmonitor.c
index 80c32565a7..99e7c87c72 100644
--- a/apps/app_mixmonitor.c
+++ b/apps/app_mixmonitor.c
@@ -1376,9 +1376,9 @@ static int load_module(void)
ast_cli_register_multiple(cli_mixmonitor, ARRAY_LEN(cli_mixmonitor));
res = ast_register_application_xml(app, mixmonitor_exec);
res |= ast_register_application_xml(stop_app, stop_mixmonitor_exec);
- res |= ast_manager_register_xml("MixMonitorMute", 0, manager_mute_mixmonitor);
- res |= ast_manager_register_xml("MixMonitor", 0, manager_mixmonitor);
- res |= ast_manager_register_xml("StopMixMonitor", 0, manager_stop_mixmonitor);
+ res |= ast_manager_register_xml("MixMonitorMute", EVENT_FLAG_SYSTEM | EVENT_FLAG_CALL, manager_mute_mixmonitor);
+ res |= ast_manager_register_xml("MixMonitor", EVENT_FLAG_SYSTEM, manager_mixmonitor);
+ res |= ast_manager_register_xml("StopMixMonitor", EVENT_FLAG_SYSTEM | EVENT_FLAG_CALL, manager_stop_mixmonitor);
return res;
}
--
GitLab