-certified/11.6-cert16
\ No newline at end of file
+certified/11.6-cert17
\ No newline at end of file
+2017-08-31 15:32 +0000 Asterisk Development Team <asteriskteam@digium.com>
+
+ * asterisk certified/11.6-cert17 Released.
+
+2017-07-01 19:24 +0000 [4c4e7303a8] Corey Farrell <git@cfware.com>
+
+ * AST-2017-006: Fix app_minivm application MinivmNotify command injection
+
+ An admin can configure app_minivm with an externnotify program to be run
+ when a voicemail is received. The app_minivm application MinivmNotify
+ uses ast_safe_system() for this purpose which is vulnerable to command
+ injection since the Caller-ID name and number values given to externnotify
+ can come from an external untrusted source.
+
+ * Add ast_safe_execvp() function. This gives modules the ability to run
+ external commands with greater safety compared to ast_safe_system().
+ Specifically when some parameters are filled by untrusted sources the new
+ function does not allow malicious input to break argument encoding. This
+ may be of particular concern where CALLERID(name) or CALLERID(num) may be
+ used as a parameter to a script run by ast_safe_system() which could
+ potentially allow arbitrary command execution.
+
+ * Changed app_minivm.c:run_externnotify() to use the new ast_safe_execvp()
+ instead of ast_safe_system() to avoid command injection.
+
+ * Document code injection potential from untrusted data sources for other
+ shell commands that are under user control.
+
+ ASTERISK-27103
+
+ Change-Id: I7552472247a84cde24e1358aaf64af160107aef1
+
+2017-05-22 10:36 +0000 [04c45758ca] Joshua Colp <jcolp@digium.com>
+
+ * res_rtp_asterisk: Only learn a new source in learn state.
+
+ This change moves the logic which learns a new source address
+ for RTP so it only occurs in the learning state. The learning
+ state is entered on initial allocation of RTP or if we are
+ told that the remote address for the media has changed. While
+ in the learning state if we continue to receive media from
+ the original source we restart the learning process. It is
+ only once we receive a sufficient number of RTP packets from
+ the new source that we will switch to it. Once this is done
+ the closed state is entered where all packets that do not
+ originate from the expected source are dropped.
+
+ The learning process has also been improved to take into
+ account the time between received packets so a flood of them
+ while in the learning state does not cause media to be switched.
+
+ Finally RTCP now drops packets which are not for the learned
+ SSRC if strict RTP is enabled.
+
+ ASTERISK-27013
+
+ Change-Id: I56a96e993700906355e79bc880ad9d4ad3ab129c
+
2016-12-08 20:29 +0000 Asterisk Development Team <asteriskteam@digium.com>
* asterisk certified/11.6-cert16 Released.
+++ /dev/null
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><title>Release Summary - asterisk-certified/11.6-cert16</title><h1 align="center"><a name="top">Release Summary</a></h1><h3 align="center">asterisk-certified/11.6-cert16</h3><h3 align="center">Date: 2016-12-08</h3><h3 align="center"><asteriskteam@digium.com></h3><hr><h2 align="center">Table of Contents</h2><ol>
-<li><a href="#summary">Summary</a></li>
-<li><a href="#contributors">Contributors</a></li>
-<li><a href="#closed_issues">Closed Issues</a></li>
-<li><a href="#commits">Other Changes</a></li>
-<li><a href="#diffstat">Diffstat</a></li>
-</ol><hr><a name="summary"><h2 align="center">Summary</h2></a><center><a href="#top">[Back to Top]</a></center><p>This release has been made to address one or more security vulnerabilities that have been identified. A security advisory document has been published for each vulnerability that includes additional information. Users of versions of Asterisk that are affected are strongly encouraged to review the advisories and determine what action they should take to protect their systems from these issues.</p><p>Security Advisories:</p><ul>
-<li><a href="http://downloads.asterisk.org/pub/security/AST-2016-009.html">AST-2016-009</a></li>
-</ul><p>The data in this summary reflects changes that have been made since the previous release, asterisk-certified/11.6-cert15.</p><hr><a name="contributors"><h2 align="center">Contributors</h2></a><center><a href="#top">[Back to Top]</a></center><p>This table lists the people who have submitted code, those that have tested patches, as well as those that reported issues on the issue tracker that were resolved in this release. For coders, the number is how many of their patches (of any size) were committed into this release. For testers, the number is the number of times their name was listed as assisting with testing a patch. Finally, for reporters, the number is the number of issues that they reported that were affected by commits that went into this release.</p><table width="100%" border="0">
-<tr><th width="33%">Coders</th><th width="33%">Testers</th><th width="33%">Reporters</th></tr>
-<tr valign="top"><td width="33%">1 Kevin Harwell <kharwell@digium.com><br/>1 Walter Doekes <walter+asterisk@wjd.nu><br/></td><td width="33%"><td width="33%">1 Walter Doekes <walter+asterisk@wjd.nu><br/></td></tr>
-</table><hr><a name="closed_issues"><h2 align="center">Closed Issues</h2></a><center><a href="#top">[Back to Top]</a></center><p>This is a list of all issues from the issue tracker that were closed by changes that went into this release.</p><h3>Bug</h3><h4>Category: Channels/chan_sip/Interoperability</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-26433">ASTERISK-26433</a>: chan_sip: Allows To-tag checks to be bypassed, setting up new calls<br/>Reported by: Walter Doekes<ul>
-<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=93dfe3964212deb8abbee7ab7f0153c64d660726">[93dfe39642]</a> Walter Doekes -- chan_sip: Do not allow non-SP/HTAB between header key and colon.</li>
-</ul><br><hr><a name="commits"><h2 align="center">Commits Not Associated with an Issue</h2></a><center><a href="#top">[Back to Top]</a></center><p>This is a list of all changes that went into this release that did not reference a JIRA issue.</p><table width="100%" border="1">
-<tr><th>Revision</th><th>Author</th><th>Summary</th></tr>
-<tr><td><a href="https://code.asterisk.org/code/changelog/asterisk?cs=c54d57a9f63171a10f2f477bb434f2b2bdcbb5a4">c54d57a9f6</a></td><td>Kevin Harwell</td><td>Update for certified/11.6-cert16</td></tr>
-</table><hr><a name="diffstat"><h2 align="center">Diffstat Results</h2></a><center><a href="#top">[Back to Top]</a></center><p>This is a summary of the changes to the source code that went into this release that was generated using the diffstat utility.</p><pre>asterisk-certified-11.6-cert15-summary.html | 23 -----
-asterisk-certified-11.6-cert15-summary.txt | 108 --------------------------
-b/.version | 2
-b/ChangeLog | 39 +++++++++
-b/asterisk-certified-11.6-cert16-summary.html | 13 +++
-b/asterisk-certified-11.6-cert16-summary.txt | 29 ++++++
-6 files changed, 82 insertions(+), 132 deletions(-)</pre><br></html>
\ No newline at end of file
+++ /dev/null
- Release Summary
-
- asterisk-certified/11.6-cert16
-
- Date: 2016-12-08
-
- <asteriskteam@digium.com>
-
- ----------------------------------------------------------------------
-
- Table of Contents
-
- 1. Summary
- 2. Contributors
- 3. Closed Issues
- 4. Other Changes
- 5. Diffstat
-
- ----------------------------------------------------------------------
-
- Summary
-
- [Back to Top]
-
- This release has been made to address one or more security vulnerabilities
- that have been identified. A security advisory document has been published
- for each vulnerability that includes additional information. Users of
- versions of Asterisk that are affected are strongly encouraged to review
- the advisories and determine what action they should take to protect their
- systems from these issues.
-
- Security Advisories:
-
- * AST-2016-009
-
- The data in this summary reflects changes that have been made since the
- previous release, asterisk-certified/11.6-cert15.
-
- ----------------------------------------------------------------------
-
- Contributors
-
- [Back to Top]
-
- This table lists the people who have submitted code, those that have
- tested patches, as well as those that reported issues on the issue tracker
- that were resolved in this release. For coders, the number is how many of
- their patches (of any size) were committed into this release. For testers,
- the number is the number of times their name was listed as assisting with
- testing a patch. Finally, for reporters, the number is the number of
- issues that they reported that were affected by commits that went into
- this release.
-
- Coders Testers Reporters
- 1 Kevin Harwell 1 Walter Doekes
- 1 Walter Doekes
-
- ----------------------------------------------------------------------
-
- Closed Issues
-
- [Back to Top]
-
- This is a list of all issues from the issue tracker that were closed by
- changes that went into this release.
-
- Bug
-
- Category: Channels/chan_sip/Interoperability
-
- ASTERISK-26433: chan_sip: Allows To-tag checks to be bypassed, setting up
- new calls
- Reported by: Walter Doekes
- * [93dfe39642] Walter Doekes -- chan_sip: Do not allow non-SP/HTAB
- between header key and colon.
-
- ----------------------------------------------------------------------
-
- Commits Not Associated with an Issue
-
- [Back to Top]
-
- This is a list of all changes that went into this release that did not
- reference a JIRA issue.
-
- +------------------------------------------------------------------------+
- | Revision | Author | Summary |
- |---------------+------------------+-------------------------------------|
- | c54d57a9f6 | Kevin Harwell | Update for certified/11.6-cert16 |
- +------------------------------------------------------------------------+
-
- ----------------------------------------------------------------------
-
- Diffstat Results
-
- [Back to Top]
-
- This is a summary of the changes to the source code that went into this
- release that was generated using the diffstat utility.
-
- asterisk-certified-11.6-cert15-summary.html | 23 -----
- asterisk-certified-11.6-cert15-summary.txt | 108 --------------------------
- b/.version | 2
- b/ChangeLog | 39 +++++++++
- b/asterisk-certified-11.6-cert16-summary.html | 13 +++
- b/asterisk-certified-11.6-cert16-summary.txt | 29 ++++++
- 6 files changed, 82 insertions(+), 132 deletions(-)
--- /dev/null
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><title>Release Summary - asterisk-certified/11.6-cert17</title><h1 align="center"><a name="top">Release Summary</a></h1><h3 align="center">asterisk-certified/11.6-cert17</h3><h3 align="center">Date: 2017-08-31</h3><h3 align="center"><asteriskteam@digium.com></h3><hr><h2 align="center">Table of Contents</h2><ol>
+<li><a href="#summary">Summary</a></li>
+<li><a href="#contributors">Contributors</a></li>
+<li><a href="#closed_issues">Closed Issues</a></li>
+<li><a href="#diffstat">Diffstat</a></li>
+</ol><hr><a name="summary"><h2 align="center">Summary</h2></a><center><a href="#top">[Back to Top]</a></center><p>This release has been made to address one or more security vulnerabilities that have been identified. A security advisory document has been published for each vulnerability that includes additional information. Users of versions of Asterisk that are affected are strongly encouraged to review the advisories and determine what action they should take to protect their systems from these issues.</p><p>Security Advisories:</p><ul>
+<li><a href="http://downloads.asterisk.org/pub/security/AST-2017-005,AST-2017-006.html">AST-2017-005,AST-2017-006</a></li>
+</ul><p>The data in this summary reflects changes that have been made since the previous release, asterisk-certified/11.6-cert16.</p><hr><a name="contributors"><h2 align="center">Contributors</h2></a><center><a href="#top">[Back to Top]</a></center><p>This table lists the people who have submitted code, those that have tested patches, as well as those that reported issues on the issue tracker that were resolved in this release. For coders, the number is how many of their patches (of any size) were committed into this release. For testers, the number is the number of times their name was listed as assisting with testing a patch. Finally, for reporters, the number is the number of issues that they reported that were affected by commits that went into this release.</p><table width="100%" border="0">
+<tr><th width="33%">Coders</th><th width="33%">Testers</th><th width="33%">Reporters</th></tr>
+<tr valign="top"><td width="33%">1 Corey Farrell <git@cfware.com><br/>1 Joshua Colp <jcolp@digium.com><br/></td><td width="33%"><td width="33%">1 Joshua Colp <jcolp@digium.com><br/>1 Corey Farrell <git@cfware.com><br/></td></tr>
+</table><hr><a name="closed_issues"><h2 align="center">Closed Issues</h2></a><center><a href="#top">[Back to Top]</a></center><p>This is a list of all issues from the issue tracker that were closed by changes that went into this release.</p><h3>Bug</h3><h4>Category: Applications/app_minivm</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-27103">ASTERISK-27103</a>: core: ast_safe_system command injection possible.<br/>Reported by: Corey Farrell<ul>
+<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=4c4e7303a88c199975a14edeb6d4c743ed7084ff">[4c4e7303a8]</a> Corey Farrell -- AST-2017-006: Fix app_minivm application MinivmNotify command injection</li>
+</ul><br><h4>Category: Applications/app_mixmonitor</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-27103">ASTERISK-27103</a>: core: ast_safe_system command injection possible.<br/>Reported by: Corey Farrell<ul>
+<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=4c4e7303a88c199975a14edeb6d4c743ed7084ff">[4c4e7303a8]</a> Corey Farrell -- AST-2017-006: Fix app_minivm application MinivmNotify command injection</li>
+</ul><br><h4>Category: Applications/app_system</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-27103">ASTERISK-27103</a>: core: ast_safe_system command injection possible.<br/>Reported by: Corey Farrell<ul>
+<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=4c4e7303a88c199975a14edeb6d4c743ed7084ff">[4c4e7303a8]</a> Corey Farrell -- AST-2017-006: Fix app_minivm application MinivmNotify command injection</li>
+</ul><br><h4>Category: Applications/app_voicemail</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-27103">ASTERISK-27103</a>: core: ast_safe_system command injection possible.<br/>Reported by: Corey Farrell<ul>
+<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=4c4e7303a88c199975a14edeb6d4c743ed7084ff">[4c4e7303a8]</a> Corey Farrell -- AST-2017-006: Fix app_minivm application MinivmNotify command injection</li>
+</ul><br><h4>Category: Channels/chan_dahdi</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-27103">ASTERISK-27103</a>: core: ast_safe_system command injection possible.<br/>Reported by: Corey Farrell<ul>
+<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=4c4e7303a88c199975a14edeb6d4c743ed7084ff">[4c4e7303a8]</a> Corey Farrell -- AST-2017-006: Fix app_minivm application MinivmNotify command injection</li>
+</ul><br><h4>Category: Core/General</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-27103">ASTERISK-27103</a>: core: ast_safe_system command injection possible.<br/>Reported by: Corey Farrell<ul>
+<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=4c4e7303a88c199975a14edeb6d4c743ed7084ff">[4c4e7303a8]</a> Corey Farrell -- AST-2017-006: Fix app_minivm application MinivmNotify command injection</li>
+</ul><br><h4>Category: Functions/func_shell</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-27103">ASTERISK-27103</a>: core: ast_safe_system command injection possible.<br/>Reported by: Corey Farrell<ul>
+<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=4c4e7303a88c199975a14edeb6d4c743ed7084ff">[4c4e7303a8]</a> Corey Farrell -- AST-2017-006: Fix app_minivm application MinivmNotify command injection</li>
+</ul><br><h4>Category: Resources/res_monitor</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-27103">ASTERISK-27103</a>: core: ast_safe_system command injection possible.<br/>Reported by: Corey Farrell<ul>
+<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=4c4e7303a88c199975a14edeb6d4c743ed7084ff">[4c4e7303a8]</a> Corey Farrell -- AST-2017-006: Fix app_minivm application MinivmNotify command injection</li>
+</ul><br><h4>Category: Resources/res_rtp_asterisk</h4><a href="https://issues.asterisk.org/jira/browse/ASTERISK-27013">ASTERISK-27013</a>: res_rtp_asterisk: Media can be hijacked even with strict RTP enabled<br/>Reported by: Joshua Colp<ul>
+<li><a href="https://code.asterisk.org/code/changelog/asterisk?cs=04c45758ca5dff91f574380ff7d8e884b71076bc">[04c45758ca]</a> Joshua Colp -- res_rtp_asterisk: Only learn a new source in learn state.</li>
+</ul><br><hr><a name="diffstat"><h2 align="center">Diffstat Results</h2></a><center><a href="#top">[Back to Top]</a></center><p>This is a summary of the changes to the source code that went into this release that was generated using the diffstat utility.</p><pre>README-SERIOUSLY.bestpractices.txt | 7 ++
+apps/app_minivm.c | 36 +++++++++-----
+apps/app_mixmonitor.c | 10 +++
+apps/app_system.c | 10 +++
+configs/minivm.conf.sample | 2
+funcs/func_shell.c | 5 +
+include/asterisk/app.h | 31 +++++++++++-
+main/asterisk.c | 93 +++++++++++++++++++++++++++++++------
+res/res_monitor.c | 13 +++--
+res/res_rtp_asterisk.c | 70 +++++++++++++++------------
+10 files changed, 213 insertions(+), 64 deletions(-)</pre><br></html>
\ No newline at end of file
--- /dev/null
+ Release Summary
+
+ asterisk-certified/11.6-cert17
+
+ Date: 2017-08-31
+
+ <asteriskteam@digium.com>
+
+ ----------------------------------------------------------------------
+
+ Table of Contents
+
+ 1. Summary
+ 2. Contributors
+ 3. Closed Issues
+ 4. Diffstat
+
+ ----------------------------------------------------------------------
+
+ Summary
+
+ [Back to Top]
+
+ This release has been made to address one or more security vulnerabilities
+ that have been identified. A security advisory document has been published
+ for each vulnerability that includes additional information. Users of
+ versions of Asterisk that are affected are strongly encouraged to review
+ the advisories and determine what action they should take to protect their
+ systems from these issues.
+
+ Security Advisories:
+
+ * AST-2017-005,AST-2017-006
+
+ The data in this summary reflects changes that have been made since the
+ previous release, asterisk-certified/11.6-cert16.
+
+ ----------------------------------------------------------------------
+
+ Contributors
+
+ [Back to Top]
+
+ This table lists the people who have submitted code, those that have
+ tested patches, as well as those that reported issues on the issue tracker
+ that were resolved in this release. For coders, the number is how many of
+ their patches (of any size) were committed into this release. For testers,
+ the number is the number of times their name was listed as assisting with
+ testing a patch. Finally, for reporters, the number is the number of
+ issues that they reported that were affected by commits that went into
+ this release.
+
+ Coders Testers Reporters
+ 1 Corey Farrell 1 Joshua Colp
+ 1 Joshua Colp 1 Corey Farrell
+
+ ----------------------------------------------------------------------
+
+ Closed Issues
+
+ [Back to Top]
+
+ This is a list of all issues from the issue tracker that were closed by
+ changes that went into this release.
+
+ Bug
+
+ Category: Applications/app_minivm
+
+ ASTERISK-27103: core: ast_safe_system command injection possible.
+ Reported by: Corey Farrell
+ * [4c4e7303a8] Corey Farrell -- AST-2017-006: Fix app_minivm application
+ MinivmNotify command injection
+
+ Category: Applications/app_mixmonitor
+
+ ASTERISK-27103: core: ast_safe_system command injection possible.
+ Reported by: Corey Farrell
+ * [4c4e7303a8] Corey Farrell -- AST-2017-006: Fix app_minivm application
+ MinivmNotify command injection
+
+ Category: Applications/app_system
+
+ ASTERISK-27103: core: ast_safe_system command injection possible.
+ Reported by: Corey Farrell
+ * [4c4e7303a8] Corey Farrell -- AST-2017-006: Fix app_minivm application
+ MinivmNotify command injection
+
+ Category: Applications/app_voicemail
+
+ ASTERISK-27103: core: ast_safe_system command injection possible.
+ Reported by: Corey Farrell
+ * [4c4e7303a8] Corey Farrell -- AST-2017-006: Fix app_minivm application
+ MinivmNotify command injection
+
+ Category: Channels/chan_dahdi
+
+ ASTERISK-27103: core: ast_safe_system command injection possible.
+ Reported by: Corey Farrell
+ * [4c4e7303a8] Corey Farrell -- AST-2017-006: Fix app_minivm application
+ MinivmNotify command injection
+
+ Category: Core/General
+
+ ASTERISK-27103: core: ast_safe_system command injection possible.
+ Reported by: Corey Farrell
+ * [4c4e7303a8] Corey Farrell -- AST-2017-006: Fix app_minivm application
+ MinivmNotify command injection
+
+ Category: Functions/func_shell
+
+ ASTERISK-27103: core: ast_safe_system command injection possible.
+ Reported by: Corey Farrell
+ * [4c4e7303a8] Corey Farrell -- AST-2017-006: Fix app_minivm application
+ MinivmNotify command injection
+
+ Category: Resources/res_monitor
+
+ ASTERISK-27103: core: ast_safe_system command injection possible.
+ Reported by: Corey Farrell
+ * [4c4e7303a8] Corey Farrell -- AST-2017-006: Fix app_minivm application
+ MinivmNotify command injection
+
+ Category: Resources/res_rtp_asterisk
+
+ ASTERISK-27013: res_rtp_asterisk: Media can be hijacked even with strict
+ RTP enabled
+ Reported by: Joshua Colp
+ * [04c45758ca] Joshua Colp -- res_rtp_asterisk: Only learn a new source
+ in learn state.
+
+ ----------------------------------------------------------------------
+
+ Diffstat Results
+
+ [Back to Top]
+
+ This is a summary of the changes to the source code that went into this
+ release that was generated using the diffstat utility.
+
+ README-SERIOUSLY.bestpractices.txt | 7 ++
+ apps/app_minivm.c | 36 +++++++++-----
+ apps/app_mixmonitor.c | 10 +++
+ apps/app_system.c | 10 +++
+ configs/minivm.conf.sample | 2
+ funcs/func_shell.c | 5 +
+ include/asterisk/app.h | 31 +++++++++++-
+ main/asterisk.c | 93 +++++++++++++++++++++++++++++++------
+ res/res_monitor.c | 13 +++--
+ res/res_rtp_asterisk.c | 70 +++++++++++++++------------
+ 10 files changed, 213 insertions(+), 64 deletions(-)
projects / thirdparty / asterisk.git / commitdiff
