[UNIX] cdr_pgsql SQL Injection Issue

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

cdr_pgsql SQL Injection Issue
------------------------------------------------------------------------

SUMMARY

Input buffers were not properly escaped when providing the ANI and DNIS
strings to the Call Detail Record Postgres logging engine. An attacker
could potentially compromise the administrative database containing users'
usernames and passwords used for SIP authentication, among other things.

This module is not active by default and must be configured for use by the
administrator. Default installations of Asterisk are not affected.

DETAILS

Vulnerable Systems:
* Asterisk Open Source version 1.2.24 and previous
* Asterisk Open Source version 1.4.14 and previous
* Asterisk Business Edition version A.x.x all versions
* Asterisk Business Edition version B.2.3.3 and previous
* Asterisk Business Edition version C.1.0-beta5 and previous

Immune Systems:
* Asterisk Open Source version 1.2.25
* Asterisk Open Source version 1.4.15
* Asterisk Business Edition version B.2.3.4
* Asterisk Business Edition version C.1.0-beta6

Workaround:
Convert your installation to use cdr_odbc with the PgsqlODBC driver. This
module provides similar functionality but is not vulnerable.

Solution:
Upgrade to Asterisk release 1.4.15 or higher.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6170>
CVE-2007-6170

ADDITIONAL INFORMATION

The information has been provided by <mailto:tlesher@digium.com> Tilghman
Lesher.
The original article can be found at:
<http://downloads.digium.com/pub/security/AST-2007-026.html>

http://downloads.digium.com/pub/security/AST-2007-026.html

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.