[asterisk-bugs] [Asterisk 0015704]: [patch] MeetMe privilege escalation in password query

[Asterisk Bug Tracker]

The following issue has been UPDATED. 
====================================================================== 
https://issues.asterisk.org/view.php?id=15704 
====================================================================== 
Reported By:                modelnine
Assigned To:                jpeeler
====================================================================== 
Project:                    Asterisk
Issue ID:                   15704
Category:                   Applications/app_meetme
Reproducibility:            always
Severity:                   major
Priority:                   normal
Status:                     closed
Target Version:             1.4.35
Asterisk Version:           SVN 
JIRA:                       SWP-1758 
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
Resolution:                 fixed
Fixed in Version:           
====================================================================== 
Date Submitted:             2009-08-12 15:43 CDT
Last Modified:              2010-07-06 15:05 CDT
====================================================================== 
Summary:                    [patch] MeetMe privilege escalation in password
query
Description: 
Due to invalid checking in the conference pin query of the MeetMe
application, a user can enter a conference as administrator when the "a"
flag is set in the MeetMe() call from the dial-plan and the user only knows
the user pin (which of course might be empty).

This stems from the fact that confflags is set to contain the ADMIN flag
by the "a" option, but this is not handled separately in the testing code
for checking the pin (i.e., the ADMIN flag is not reset or the
authentication rejected when the user doesn't enter the admin, but the user
pin).

The attached patch fixes the issue for conferences which have an empty
user-pin (which is the only reasonable assumption I could find for actually
giving the "a" flag on the MeetMe() commandline); reworking the patch to
fix the issue in the general case (i.e., if "a" is specified, only admins
may enter) is simple.
======================================================================
Relationships       ID      Summary
----------------------------------------------------------------------
related to          0015707 [patch] Passing the mute flag to MeetMe...
====================================================================== 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2010-07-06 15:05 lmadsen        Target Version            => 1.4.35          
2010-07-06 15:05 lmadsen        Description Updated                          
======================================================================