The AEL compiler generates extensions from the "case"s in
a switch{} block. A SIP user might guess one of the
sw-X-.. extensions and execute dialplan code which he
shouldn't be allowed to execute.

See the mail in additional information from the -dev list.
Steve Murphy suggested to open a bug report.

• • • • • • ADDITIONAL INFORMATION ******

On Mon, 2007-03-19 at 14:39 +0100, Philipp Kempgen wrote:
> > Steve Murphy wrote:
> >
>> > > On Mon, 2007-03-19 at 12:32 +0100, Philipp Kempgen wrote:
>>> > >> Philipp Kempgen wrote:
>>> > >>
>>>> > >>> Sergey Okhapkin wrote:
>>>> > >>>
>>>>> > >>>> AEL needs to use extensions when compiling "switch" statement, asterisk
>>>>> > >>>> extensions pattern match is being used for "default" case.
>>>>> > >>>>
>>>>> > >>>> On Monday 19 March 2007 06:39, Philipp Kempgen wrote:
>>>>>> > >>>>> Philipp Kempgen wrote:
>>>>>>> > >>>>>> It seems like AEL compiles labels into extensions.
>>>>>>> > >>>>>> So a users could directly dial to a label which seems
>>>>>>> > >>>>>> like a security risk to me. Am I missing something?
>>>>>> > >>>>> Need to correct myself: AEL compiles the cases in a switch
>>>>>> > >>>>> block into extensions. Labels remain untouched. But that
>>>>>> > >>>>> doesn't make it any better.
>>>> > >>> Features are not an excuse for weak security.
>>> > >> And although it is implemented this way the AEL compiler could
>>> > >> use something like this for the default case:
>>> > >>
>>> > >> exten => 123,n,GotoIf($["$

" = "NOANSWER"]?user_unavail)
>>> > >> exten => 123,n,Goto(default)
>> > >
>> > > Philipp--
>> > >
>> > > Please help me to understand the security implications here. I could
>> > > invest some time and re-do the stuff for switch statements without using
>> > > extensions... is it
>> > > that the creation of the extra extensions might be addressable from
>> > > outside your
>> > > org? So, putting Dial() commands to targets outside the org could be the
>> > > risk? Are there others that I'm not thinking of? AEL compiles switch
>> > > cases into extensions with names like: sw-<a generated integer>-<Case
>> > > Label>, and for the
>> > > default condition, it generates "." as the case label, eg. sw-32-.
>> > >
>> > > So, as I see it, the risk is that a clever attacker will make
>> > > sip/iax/etc calls to your system with addresses like "sw-2-BUSY", (PSTN
>> > > calls would only be able to provide numeric extension names) looking for
>> > > a switch case that might give him a free ticket to the PSTN?
> >
> > Exactly. One of the internal users might figure this out
> > and change settings of other users, listen to other users'
> > voicemail, whatever. Although this is not very likely I
> > see the potential risk.

Thanks, Philipp--

Could you open a bug on bugs.digium.com, and explain this there, and
I'll schedule a re-do that avoids the creation of extensions for
switches. I don't
see that this is a critical risk, as DISA *should* be provided with a
password, if you care about security, and Authenticate just hangs up on
failure instead of returning a result you'd want to use in a switch...
but you are right, in unexpected places, and in unexpected ways, some
wiseguy with a sip connection could be trying random (or worse yet,
thoughtful) extensions of the form sw-3-x to get potentially juicy
extensions to be executed. How fruitful this would be, I cannot predict,
but there is a possibility that it could be fruitful, I must admit.

murf

> >
> > Regards,
> > Philipp
> >

_______________________________________________
--Bandwidth and Colocation provided by Easynews.com –

asterisk-dev mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-dev