Critical Update Released

[wardmundy]

We've released a patch to the Kennonsoft main menu that adddresses a critical permission problem. This is an important update and should be applied to all systems as soon as possible. Note we have released it for all versions of PBX in a Flash.

To apply it, log into your server as root and...

(for Asterisk 1.4 based installs)

update-scripts

then

update-fixes


(for Asterisk 1.6 based installs)

update-scripts16

then

update-fixes16

As a precaution, until everyone has had an opportunity to apply the patch, we don't plan to release further details. So... don't ask. If we told you, we'd have to kill you.

 

[cosmicwombat]

Ah yes...

But, how will you know when everyone has applied the patch...
Hmmmmm...?

 

[stucker]

Patch

As always, thanks for keeping us informed and up-to-date Ward!

-stucker

 

[wardmundy]

But, how will you know when everyone has applied the patch...
Hmmmmm...?

Well, you're right, of course. Just keep in mind that the only purpose of this password was to keep people out of the Admin menu. It didn't stop anyone from typing /admin. So it was next to worthless except to deter the casual observer who knew nothing about FreePBX or Asterisk. It turns out the password was about that secure, too.

So... the real risk is that someone might use the same password for the Admin UI as well as their other more important Linux, Asterisk and FreePBX accounts. That would be a very bad thing. This patch addresses this by better protecting the password. Now we have to kill you.

 

[cosmicwombat]

Ah, I see...

Catch me if you can....

btw, i added the Aastra auto config bit... How cool is that!

Thanks Ward.

 

[dschargel]

Can you explain what you mean by "i added the Aastra auto config bit"??? I have a custom Aastra setup and I don't want a conflict between your changes and what I have worked to develop.

 

[wardmundy]

The Aastra discussion has nothing to do with this update or this thread. Please post it separately in the appropriate forum if you have a concern.

 

[Qwertology]

Um, logged in as root and typing update-scripts just gives me a "-bash: update-scripts: command not found" message.

I am on 1.4.13 so maybe doing something wrong? Any ideas?

 

[darmock]

look in /usr/local/sbin

if it is not there then you may be running a version prior to 1.1 or you hav deleted these fies somwhow

tom

 

[Qwertology]

you may be running a version prior to 1.1

Thanks for that. Yeah, I'm on Piaf 1.0.

Having searched the forum, I came across one of your posts that gave a link to a page on updating from 1.0, but unfortunately the link took me to a "page not found" error.

I'll probably just install 1.2 and start again as there are a couple of other minor issues.