AST-2014-006: Asterisk Manager User Unauthorized Shell Access

Asterisk Project Security Advisory - AST-2014-006

          Product         Asterisk
          Summary         Asterisk Manager User Unauthorized Shell Access
     Nature of Advisory   Permission Escalation
       Susceptibility     Remote Authenticated Sessions
          Severity        Minor
       Exploits Known     No
        Reported On       April 9, 2014
        Reported By       Corey Farrell
         Posted On        June 12, 2014
      Last Updated On     June 12, 2014
      Advisory Contact    Jonathan Rose < jrose AT digium DOT com >
          CVE Name        CVE-2014-4046

    Description  Manager users can execute arbitrary shell commands with the
                 MixMonitor manager action. Asterisk does not require system
                 class authorization for a manager user to use the
                 MixMonitor action, so any manager user who is permitted to
                 use manager commands can potentially execute shell commands
                 as the user executing the Asterisk process.


    Resolution  Upgrade to a version with the patch integrated, apply the
                patch, or do not allow users who should not have permission
                to run shell commands to use AMI.

                               Affected Versions
                 Product               Release Series
          Asterisk Open Source              11.x       All
          Asterisk Open Source              12.x       All
           Certified Asterisk               11.6       All

                                  Corrected In
                   Product                              Release
             Asterisk Open Source                   11.10.1, 12.3.1
              Certified Asterisk                       11.6-cert3

                                     Patches
                                SVN URL                              Revision
   http://downloads.asterisk.org/pub/security/AST-2014-006-11.diff   Asterisk
                                                                     11
   http://downloads.asterisk.org/pub/security/AST-2014-006-12.diff   Asterisk
                                                                     12
   http://downloads.asterisk.org/pub/security/AST-2014-006-11.6.diff Certified
                                                                     Asterisk
                                                                     11.6

       Links     https://issues.asterisk.org/jira/browse/ASTERISK-23609

    Asterisk Project Security Advisories are posted at
    http://www.asterisk.org/security

    This document may be superseded by later versions; if so, the latest
    version will be posted at
    http://downloads.digium.com/pub/security/AST-2014-006.pdf and
    http://downloads.digium.com/pub/security/AST-2014-006.html

                                Revision History
          Date                  Editor                 Revisions Made
    April 23, 2014     Jonathan Rose             Document Creation
    June 12, 2014      Matt Jordan               Added CVE

               Asterisk Project Security Advisory - AST-2014-006
              Copyright (c) 2014 Digium, Inc. All Rights Reserved.
  Permission is hereby granted to distribute and publish this advisory in its
                           original, unaltered form.