[asterisk-bugs] [Asterisk 0015704]: [patch] MeetMe privilege escalation in password query

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=15704 
====================================================================== 
Reported By:                modelnine
Assigned To:                
====================================================================== 
Project:                    Asterisk
Issue ID:                   15704
Category:                   Applications/app_meetme
Reproducibility:            always
Severity:                   major
Priority:                   normal
Status:                     confirmed
Asterisk Version:           1.6.1.2 
Regression:                 No 
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2009-08-12 15:43 CDT
Last Modified:              2009-08-17 15:58 CDT
====================================================================== 
Summary:                    [patch] MeetMe privilege escalation in password
query
Description: 
Due to invalid checking in the conference pin query of the MeetMe
application, a user can enter a conference as administrator when the "a"
flag is set in the MeetMe() call from the dial-plan and the user only knows
the user pin (which of course might be empty).

This stems from the fact that confflags is set to contain the ADMIN flag
by the "a" option, but this is not handled separately in the testing code
for checking the pin (i.e., the ADMIN flag is not reset or the
authentication rejected when the user doesn't enter the admin, but the user
pin).

The attached patch fixes the issue for conferences which have an empty
user-pin (which is the only reasonable assumption I could find for actually
giving the "a" flag on the MeetMe() commandline); reworking the patch to
fix the issue in the general case (i.e., if "a" is specified, only admins
may enter) is simple.
====================================================================== 

---------------------------------------------------------------------- 
 (0109182) modelnine (reporter) - 2009-08-17 15:58
 https://issues.asterisk.org/view.php?id=15704#c109182 
---------------------------------------------------------------------- 
The attached patch contains a more comprehensive fix for the problem, in
that it actually tests which password to compare against (using confflags)
when fetching and comparing the password.

The patch also includes "enhancements" that are related to
https://issues.asterisk.org/view.php?id=15707, which I
didn't want to break out. I can't put the two bugs into relation, though. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-08-17 15:58 modelnine      Note Added: 0109182                          
======================================================================