----------------------------------------------------------------------

Are you missing:

SECUNIA ADVISORY ID:

Critical:

Impact:

Where:

within the advisory below?

This is now part of the Secunia commercial solutions.

Click here to learn more about our commercial solutions:
http://secunia.com/advisories/business_solutions/
        
Click here to trial our solutions:
http://secunia.com/advisories/try_vi/

----------------------------------------------------------------------

TITLE:
freePBX Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA34772

VERIFY ADVISORY:
http://secunia.com/advisories/34772/

DESCRIPTION:
Some vulnerabilities and a weakness have been discovered in freePBX,
which can be exploited by malicious people to disclose certain system
information, and to conduct cross-site scripting and cross-site
request forgery attacks.

1) Input passed e.g. to "display" parameter in reports.php, to the
"order" and "extdisplay" parameters in config.php, to the "sort"
parameter in recordings/index.php is not properly sanitised before
being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context
of an affected site.

2) The application allows users to perform certain actions via HTTP
requests without performing any validity check to verify the
requests. This can be exploited to perform certain administrative
actions (e.g. create a new administrative user) when a logged-in
admin visits a malicious web site.

3) A weakness is caused due to the application returning different
error messages depending on whether an unsuccessful login attempt is
performed with a valid or invalid user name.This can be exploited to
enumerate valid user names.

The vulnerabilities and the weakness are confirmed in version 2.5.1.
Other versions may also be affected.

SOLUTION:
Install the updated modules.

freePBX 2.4:
http://freepbx.org/trac/changeset/7659

freePBX 2.5:
http://freepbx.org/trac/changeset/7650
http://freepbx.org/trac/changeset/7651

freePBX 2.6/trunk:
http://freepbx.org/trac/changeset/7660
http://freepbx.org/trac/changeset/7661

PROVIDED AND/OR DISCOVERED BY:
1) Mike Bailey and Dejan Levaja
2) Mike Bailey
3) Dejan Levaja

ORIGINAL ADVISORY:
freePBX:
http://freepbx.org/trac/ticket/3660

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------