FreePBX Security Vulnerability

[wardmundy]

Would anyone out there be interested in my starting a series of weekly security talks aimed at developers so that I can go over vulnerabilities, a walk through of how they work, how their existence means a software security principle has been broken, and how to fix the root cause so it doesn't come back?

This is something that I think more and more people within the Asterisk community would benefit from and I'm hoping the end result would be an understanding of software security principles as well as coding standards for any Asterisk related project.

Kevin

Very interested. We're still trying to put a conference together. One way or another, we need to make a video so it gets preserved. Thanks for all you do and have done for our project!!!

 

[wardmundy]

Great, your saying now I have to figure why apache crashed and I can't access my machine?

It would probably be faster to format and install "The Incredible PBX".

Not only faster... but also safer.

 

[jroper]

Would anyone out there be interested in my starting a series of weekly security talks aimed at developers so that I can go over vulnerabilities, a walk through of how they work, how their existence means a software security principle has been broken, and how to fix the root cause so it doesn't come back?

This is something that I think more and more people within the Asterisk community would benefit from and I'm hoping the end result would be an understanding of software security principles as well as coding standards for any Asterisk related project.

Hi

As a serial creator of ISO's, I would be happy to attend/assist.

Joe

 

[jtjacobs]

Would anyone out there be interested in my starting a series of weekly security talks aimed at developers so that I can go over vulnerabilities, a walk through of how they work, how their existence means a software security principle has been broken, and how to fix the root cause so it doesn't come back?

This is something that I think more and more people within the Asterisk community would benefit from and I'm hoping the end result would be an understanding of software security principles as well as coding standards for any Asterisk related project.

Kevin

Definately! They should also be preserved as Ward stated be it Video, Open Office Impress, PDF, podcast, or other format...

 

[mark-hc]

I checked the Logs of my server and confirmed that it was not hacked. Apache however had a panic attack and froze up. And for some reason Numerous directories had their permissions changed.

I think the root of the problem lies somewhere in all the FreePBX updates that have been happening in the last couple of weeks. Something, somewhere didn't like what was happening.

Instead of trying to bandage the system up, I'm going to spinup the latest "Incredible PBX".

 

[dallas]

Would anyone out there be interested in my starting a series of weekly security talks aimed at developers so that I can go over vulnerabilities, a walk through of how they work, how their existence means a software security principle has been broken, and how to fix the root cause so it doesn't come back?

This is something that I think more and more people within the Asterisk community would benefit from and I'm hoping the end result would be an understanding of software security principles as well as coding standards for any Asterisk related project.

Kevin

Count me in too. Given the time difference I would need the podcast etc. Australia is 'the other side of the world' from almost everywhere.

 

[Bitnetix]

Was there ever any forward movement on this? The security "talks," not the exploit.

 

[dbaum]

Ward, since today's application of updated 2.7 modules the following error is occuring:
retrieve_conf failed to sym link:
/var/lib/asterisk/bin/retrieve_op_conf_from_mysql.pl
/var/lib/asterisk/bin/retrieve_op_conf_from_mysql.php
This can result in FATAL failures to your PBX. If the target file exists, the symlink will not occur and you should rename the target file to allow the automatic sym link to occur and remove this error, unless this is an intentional customization.
Added 35 minutes ago
(retrieve_conf.SYMLINK)

 

[wardmundy]

PIAF currently does not endorse FreePBX 2.7. Any upgrade settings are performed by FreePBX as part of the update process so... you probably need to file a bug report in the FreeePBX Bug Tracker.

 

[jroper]

Hi

/var/lib/asterisk/bin/retrieve_op_conf_from_mysql.pl
/var/lib/asterisk/bin/retrieve_op_conf_from_mysql.php

So it's not just me then. This seemed to occur on a new installation last night using a script I've used for years. I can only assume a glitch in the update process.

Delete these two files, and then edit an extension, trunk whatever, and then press the orange bar at the top of FreePBX, and the symlinks for these two files will be recreated in the /var/lib/asterisk/bin/, and the error message will go away.

Personally, I've found FreePBX 2.7 absolutely fine, and the more people who use the later version and put bug reports, in the better future versions get, not withstanding comments about early adopters and arrows in the back

Joe

 

[dswartz]

I have also found 2.7 to be rock solid.

 

[wardmundy]

Good to hear. Does this glitch occur with every upgrade or just sometimes?

 

[Bitnetix]

We have 2.7 boxes running without problems. Including Revos (such cute li'l boxes!)

 

[MyKroFt]

I have updated 4 boxes to 2.7 and beyond and have yet to have this happen - sounds like it was just a fluke to me....

 

[edisoninfo]

i just updated my box and had similar errors. Besides those two files I also got:


/etc/asterisk/sip_notify.conf
/var/www/html/admin/images/delete.gif

 

[kenn10]

Have you rebooted the system after the upgrade? Not just an amportal restart.

 

[edisoninfo]

Have you rebooted the system after the upgrade? Not just an amportal restart.

No I didn't. Was I supposed to? I don't remember rebooting after any of the other FreePBX upgrades. I followed the error message instructions and moved the four files off to the side and it corrected the two ...mysql files/links on it's own. It still shows these two files as being errors tho. I'll try rebooting after hours.

 

[kenn10]

Also see this

freepbx.org/forum/freepbx/users/sym...-on-status-screen-after-upgrade#comment-27203

It is apparently a non-critical bug. I got the error when I upgraded from 2.7 to 2.8RC1. Rebooting cleared it in my case. The bug has been reported to FreePBX.

 

[edisoninfo]

i just updated my box and had similar errors. Besides those two files I also got:

/etc/asterisk/sip_notify.conf
/var/www/html/admin/images/delete.gif

It seems to be the endpoint manager module is redirecting these symlinks which conflicts with whatever FreePBX is trying to set the symlinks to.