TUCoPS :: Asterisk :: b06-1777.htm

directory traversal in Asterisk@Home and ARI
directory traversal in Asterisk@Home and ARI
directory traversal in Asterisk@Home and ARI

ID     :              2006.1
Product :          ARI (Asterisk Recording Interface)
                        Asterisk@home Distribution
Affected product : <= 0.7.15 (Asterisk@Home 2.6 and lower)
Class :              Access to protected information, directory traversal
Remote :          yes
Author :           Francois Harvey 
Published date :   2006-04-20 (Initial Vendor contact 2006-03-06)
Reference URL :  
Solution :         Use the last ARI version or use asterisk@home 2.8

Two vulnerabilities was found in the ARI package included in the  
asterisk@home Distribution. These vulnerabilities allow a user to listen 
voicemail from any other users and and to disclose configuration password.

Vulnerability 1

The config file is in a public directory and not protected by default

Exploit : http:///recordings/includes/main.conf 

This should list all the configuration of ARI. With asterisk password, 
db password, admin password.

Vulnerability 2

A directory traversal/file retreival exist in the ARI web interface.
This script allow a user to download any mp3/wav/gsm on the system. No 
authentification is needed, this can be used to listen voicemail from 
another user.

Exploit : 

This flaw can also be used to verify the presence of a file on the server
Cannot use file: xxx <-- file exist bot not the good extension
404 File not found! <--- file doesn't exist

Both asterisk@home and ARI released fixes

Francois Harvey 
SecuriWeb inc | www.securiweb.net 

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH