<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
As I pointed out here last night, there is also a very serious security vulnerability associated with this. Example: An attacker could compromise the script that is used on the remote host, and set it to force clients that connect to run a command such as "rm -rf /". There are about half a dozen ways I could see this being abused - in either a "one off" or an "every installation" scenario. Fonality has yet to acknowledge this aspect of the issue - and I fear that they never will.<br><br>See:<br>http://voipsa.org/pipermail/voipsec_voipsa.org/2007-December/002522.html<br><br><br>P.S.: On behalf of Rob (of FreePBX fame), I'd like to also point out this
this is something that was added to trixbox, and not FreePBX. Quoting
Rob: "when someone mistakenly says 'trixbox does...' they usually mean
'freepbx does...' as FreePBX is the GUI Trixbox uses to configure
Asterisk". In this instance, that is not the case - it is only a
trixbox issue.<br><br>> From: email@mattruby.com<br>> To: asterisk-users@lists.digium.com; asterisk-biz@lists.digium.com<br>> Date: Sun, 16 Dec 2007 20:53:53 -0500<br>> Subject: [asterisk-users] Trixbox Phones Home<br>> <br>> I just read on Slashdot (at<br>> http://yro.slashdot.org/article.pl?sid=07/12/16/222243 ) that Trixbox<br>> "has been phoning home with statistics about their installations", as a<br>> Trixbox user exposed in "Trixbox Phones Home" at<br>> http://www.trixbox.org/forums/trixbox-forums/open-discussion/trixbox-phones-home .<br>> -- <br>> <br>> (C) Matthew Rubenstein<br>> <br>> <br>> _______________________________________________<br>> --Bandwidth and Colocation Provided by http://www.api-digital.com--<br>> <br>> asterisk-users mailing list<br>> To UNSUBSCRIBE or update options visit:<br>> http://lists.digium.com/mailman/listinfo/asterisk-users<br><br /><hr />The best games are on Xbox 360. Click here for a special offer on an Xbox 360 Console. <a href='http://www.xbox.com/en-US/hardware/wheretobuy/' target='_new'>Get it now!</a></body>
</html>