mailing list archives
[SecuriWeb 2006.1] directory traversal in Asterisk () Home and ARI
From: François Harvey <fharvey () securiweb net>
Date: Thu, 20 Apr 2006 23:15:45 -0400
ID : 2006.1
Product : ARI (Asterisk Recording Interface)
Asterisk () home Distribution
Affected product : <= 0.7.15 (Asterisk () Home 2.6 and lower)
Class : Access to protected information, directory traversal
Remote : yes
Author : Francois Harvey <fharvey at securiweb dot net>
Published date : 2006-04-20 (Initial Vendor contact 2006-03-06)
Reference URL :
Solution : Use the last ARI version or use asterisk () home 2.8
Two vulnerabilities was found in the ARI package included in the
asterisk () home Distribution. These vulnerabilities allow a user to listen
voicemail from any other users and and to disclose configuration password.
The config file is in a public directory and not protected by default
Exploit : http://<asterisk>/recordings/includes/main.conf
This should list all the configuration of ARI. With asterisk password,
db password, admin password.
A directory traversal/file retreival exist in the ARI web interface.
This script allow a user to download any mp3/wav/gsm on the system. No
authentification is needed, this can be used to listen voicemail from
This flaw can also be used to verify the presence of a file on the server
Cannot use file: xxx <-- file exist bot not the good extension
404 File not found! <--- file doesn't exist
Both asterisk () home and ARI released fixes
Francois Harvey <fharvey at securiweb dot net>
SecuriWeb inc | www.securiweb.net
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- [SecuriWeb 2006.1] directory traversal in Asterisk () Home and ARI François Harvey (Apr 21)