[asterisk-bugs] [JIRA] (ASTERISK-24969) Named ACL's do not handle config errors.

[Mark Michelson (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-24969?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Mark Michelson updated ASTERISK-24969:
--------------------------------------

    Security:     (was: Reporter, Bug Marshals, and Digium)

> Named ACL's do not handle config errors.
> ----------------------------------------
>
>                 Key: ASTERISK-24969
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-24969
>             Project: Asterisk
>          Issue Type: Bug
>          Components: Core/ACL
>    Affects Versions: 11.17.1, 13.3.2
>            Reporter: Corey Farrell
>         Attachments: acl.diff, ASTERISK-24969-acl-critical-startup.patch
>
>
> While investigating ASTERISK-24874 I found that an invalid acl.conf leaves the system vulnerable.
> # Invalid acl.conf on startup does not abort startup.  ACL's are critical to security so this can be dangerous to allow the system to run in this state.
> # Even if we do not abort startup, running CLI {{module reload acl}} produces no output, leaving the admin to believe that ACL's were successfully loaded.
> I'm not convinced this is a security issue, this ticket is locked down for now until others can decide if it should be kept quiet or posted in the open.



--
This message was sent by Atlassian JIRA
(v6.2#6252)