Asterisk Manager Interface Overflow
Wade Alcorn discovered this vulnerability whilst performing an assessment of the Asterisk PABX software package. It was then verified that the instruction pointer could be controlled and made to point at arbitrary memory locations. This led to a remote shell proof-of-concept, which provides access to the user (root by default) running Asterisk. This will occur when the Asterisk Manager Interface is enabled and a valid manager username and password, with command line permissions, is used.
Researcher
Vulnerable system
This vulnerability affects Asterisk 1.0.7 and earlier.
Affected systems
The issue was initially found and verified on the Linux Operating System. Research is currently being undertaken to determine the extent to which other operating systems are vulnerable.
Details
There is a programming error in the function that parses commands in the Asterisk system. This is used by the manager interface if the user is allowed to submit CLI commands. The coding error can result in the overflow of one of the parameters of the calling function. That is, the command parsing function will return without error. However, the calling function will cause a segmentation fault.
If the command string is specifically crafted, is it possible to use this stack overflow to execute arbitrary code on the Asterisk system. The resulting execution is (typically) run with root privileges.
A command consisting of a recurring string of two double quotes followed by a tab character will induce the segmentation fault within a Call Manager thread.
Impact
Under the default configuration the Asterisk server does not start the Manager interface, so a default Asterisk installation will not be vulnerable to this avenue of attack.
The impact of this issue is mitigated by the Asterisk default configuration. Configuration is controlled by settings in manager.conf. The following options need to be in place for this vector of attack to be successful:
[general]
enabled = yes
bindaddr = 127.0.0.1
[mark]
secret = mysecret
permit = 127.0.0.1
write = command The relevant option is 'write = command'; without it, even properly authenticated Manager interface users will be unable to exploit this overflow.
The result of a successfully exploited Asterisk command parsing overflow will result in a remote root shell.
Exploit
The error in the function means that any Asterisk server with the appropriate configuration using the Manager interface is vulnerable. It is possible for an authenticated user to gain a remote root shell on the system.
Workaround/Fix
* For a temporary workaround, disable the setting in manager.conf detailed in the impact section. OR
* Upgrade to version 1.0.8, or for development branch users, the most recent CVS version available.