[asterisk-dev] Dialstring injection - security advisory release?

[Kevin P. Fleming]

Leif Madsen wrote:

> How many of those companies with guest access are allowing outbound dialing from 
> the guest account though? I'd hope closer to zero than to one :)

That's the whole point! If the context that 'guest' calls land in does
not have 'outbound dialing access' (meaning it doesn't have any
extensions that can be dialed that dial out through DAHDI/g0), but it
does have an _X. extension that can be used to dial 'internal
extensions' in the PBX, then it's vulnerable! A guest caller can 'call'
"201&DAHDI/g0/19769769767" and they are using the system in a way it was
not intended.

-- 
Kevin P. Fleming
Digium, Inc. | Director of Software Technologies
445 Jan Davis Drive NW - Huntsville, AL 35806 - USA
skype: kpfleming | jabber: kfleming at digium.com
Check us out at www.digium.com & www.asterisk.org