From 42cbef3e5ae7987d3c8f0164170855d342bdbd0a Mon Sep 17 00:00:00 2001 From: Florian Fainelli Date: Tue, 25 Sep 2012 13:37:04 +0000 Subject: [PATCH] [package] asterisk-1.8.x: add patch to fix CVE-2012-2186 SVN-Revision: 33541 --- net/asterisk-1.8.x/Makefile | 2 +- net/asterisk-1.8.x/patches/600-CVE-2012-2186.patch | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) create mode 100644 net/asterisk-1.8.x/patches/600-CVE-2012-2186.patch diff --git a/net/asterisk-1.8.x/Makefile b/net/asterisk-1.8.x/Makefile index 0766dfd562..6c769cc9ea 100644 --- a/net/asterisk-1.8.x/Makefile +++ b/net/asterisk-1.8.x/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=asterisk18 PKG_VERSION:=1.8.10.1 -PKG_RELEASE:=1 +PKG_RELEASE:=2 PKG_SOURCE:=asterisk-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=http://downloads.asterisk.org/pub/telephony/asterisk/releases/ diff --git a/net/asterisk-1.8.x/patches/600-CVE-2012-2186.patch b/net/asterisk-1.8.x/patches/600-CVE-2012-2186.patch new file mode 100644 index 0000000000..dbe790b8a5 --- /dev/null +++ b/net/asterisk-1.8.x/patches/600-CVE-2012-2186.patch @@ -0,0 +1,10 @@ +--- a/main/manager.c ++++ b/main/manager.c +@@ -4020,6 +4020,7 @@ static int action_originate(struct manse + TryExec(System(rm -rf /)) */ + strcasestr(app, "agi") || /* AGI(/bin/rm,-rf /) + EAGI(/bin/rm,-rf /) */ ++ strcasestr(app, "externalivr") || /* ExternalIVR(rm -rf) */ + strstr(appdata, "SHELL") || /* NoOp(${SHELL(rm -rf /)}) */ + strstr(appdata, "EVAL") /* NoOp(${EVAL(${some_var_containing_SHELL})}) */ + )) { -- 2.30.2