kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-22 12:52:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixing a potential buffer overflow in the manager command ModuleCheck.

Browse Source 
Though this overflow is exploitable remotely, we are NOT issuing a security
advisory for this since in order to exploit the overflow, the attacker would
have to establish an authenticated manager session AND have the system privilege.
By gaining this privilege, the attacker already has more powerful weapons at his
disposal than overflowing a buffer with a malformed manager header, so the vulnerability
in this case really lies with the authentication method that allowed the attacker to 
gain the system privilege in the first place.



git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@108529 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Mark Michelson
2008-03-13 20:59:00 +00:00
parent 5aba7c1cbe
commit d236e3d1b1
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
main/manager.c
View File

@@ -2634,14 +2634,14 @@ static int manager_modulecheck(struct mansession *s, const struct message *m)
} else {
cut = filename + strlen(filename);
}
sprintf(cut, ".so");
snprintf(cut, sizeof(filename) - cut - 1, ".so");
ast_log(LOG_DEBUG, "**** ModuleCheck .so file %s\n", filename);
res = ast_module_check(filename);
if (!res) {
astman_send_error(s, m, "Module not loaded");
return 0;
}
sprintf(cut, ".c");
snprintf(cut, sizeof(filename) - cut - 1, ".c");
ast_log(LOG_DEBUG, "**** ModuleCheck .c file %s\n", filename);
version = ast_file_version_find(filename);