AST-2012-012: Asterisk Manager User Unauthorized Shell Access

           Asterisk Project Security Advisory - AST-2012-012

      Product         Asterisk                                            
      Summary         Asterisk Manager User Unauthorized Shell Access     
 Nature of Advisory   Permission Escalation                               
   Susceptibility     Remote Authenticated Sessions                       
      Severity        Minor                                               
   Exploits Known     No                                                  
    Reported On       July 13, 2012                                       
    Reported By       Zubair Ashraf of IBM X-Force Research               
     Posted On        August 30, 2012                                     
  Last Updated On     August 30, 2012                                     
  Advisory Contact    Matt Jordan < mjordan AT digium DOT com >           
      CVE Name        CVE-2012-2186                                       

Description  The AMI Originate action can allow a remote user to specify  
             information that can be used to execute shell commands on    
             the system hosting Asterisk. This can result in an unwanted  
             escalation of permissions, as the Originate action, which    
             requires the "originate" class authorization, can be used    
             to perform actions that would typically require the          
             "system" class authorization. Previous attempts to prevent   
             this permission escalation (AST-2011-006, AST-2012-004)      
             have sought to do so by inspecting the names of              
             applications and functions passed in with the Originate      
             action and, if those applications/functions matched a        
             predefined set of values, rejecting the command if the user  
             lacked the "system" class authorization. As reported by IBM  
             X-Force Research, the "ExternalIVR" application is not       
             listed in the predefined set of values. The solution for     
             this particular vulnerability is to include the              
             "ExternalIVR" application in the set of defined              
             applications/functions that require "system" class           
             authorization.                                               
                                                                          
             Unfortunately, the approach of inspecting fields in the      
             Originate action against known applications/functions has a  
             significant flaw. The predefined set of values can be        
             bypassed by creative use of the Originate action or by       
             certain dialplan configurations, which is beyond the         
             ability of Asterisk to analyze at run-time. Attempting to    
             work around these scenarios would result in severely         
             restricting the applications or functions and prevent their  
             usage for legitimate means. As such, any additional          
             security vulnerabilities, where an application/function      
             that would normally require the "system" class               
             authorization can be executed by users with the "originate"  
             class authorization, will not be addressed. Instead, the     
             README-SERIOUSLY.bestpractices.txt file has been updated to  
             reflect that the AMI Originate action can result in          
             commands requiring the "system" class authorization to be    
             executed. Proper system configuration can limit the impact   
             of such scenarios.                                           
                                                                          
             The next release of each version of Asterisk will contain,   
             in addition to the fix for the "ExternalIVR" application,    
             an updated README-SERIOUSLY.bestpractices.txt file.          

Resolution  Asterisk now checks for the "ExternalIVR" application when    
            processing the Originate action.                              
                                                                          
            Additionally, the README-SERIOUSLY.bestpractices.txt file     
            has been updated. It is highly recommended that, if AMI is    
            utilized with accounts that have the "originate" class        
            authorization, Asterisk is run under a defined user that      
            does not have root permissions. Accounts with the             
            "originate" class authorization should be treated in a        
            similar manner to those with the "system" class               
            authorization.                                                

                           Affected Versions
           Product                 Release Series       
    Asterisk Open Source                1.8.x           All versions      
    Asterisk Open Source                10.x            All versions      
     Certified Asterisk                1.8.11           All versions      
    Asterisk Digiumphones        10.x.x-digiumphones    All versions      
  Asterisk Business Edition             C.3.x           All versions      

                              Corrected In
               Product                              Release               
         Asterisk Open Source                   1.8.15.1, 10.7.1          
          Certified Asterisk                      1.8.11-cert6            
        Asterisk Digiumphones                 10.7.1-digiumphones         
      Asterisk Business Edition                     C.3.7.6               

                                Patches                         
                           SVN URL                              Revision  

http://downloads.asterisk.org/pub/security/AST-2012-012-1.8.diff Asterisk
1.8
http:downloads.asterisk.org/pub/security/AST-2012-012-10.diff Asterisk
10

   Links     https://issues.asterisk.org/jira/browse/ASTERISK-20132       

Asterisk Project Security Advisories are posted at                        
http://www.asterisk.org/security                                          
                                                                          
This document may be superseded by later versions; if so, the latest      
version will be posted at                                                 
http://downloads.digium.com/pub/security/AST-2012-012.pdf and             
http://downloads.digium.com/pub/security/AST-2012-012.html                

                            Revision History
      Date                  Editor                 Revisions Made         
08/27/2012         Matt Jordan               Initial version              

           Asterisk Project Security Advisory - AST-2012-012
          Copyright (c) 2012 Digium, Inc. All Rights Reserved.

Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.