Summary:	ASTERISK-07715: [patch] [post-1.4] security enchancments when using exec, system, rename etc.
Reporter:	nick gavrikov (nick gavrikov)	Labels:
Date Opened:	2006-09-11 06:02:44	Date Closed:	2011-06-07 14:02:41
Priority:	Major	Regression?	No
Status:	Closed/Complete	Components:	Core/General
Versions:		Frequency of Occurrence
Related Issues:
Environment:		Attachments:	( 0) 8last.patch ( 1) Clast.patch ( 2) Dlast.patch
Description:	This is my security enchancments for launching external programs. This patch adds functions for safe copying, renaming files, for creating directories and for spawning external programs. Also it replaces such constructions:   size = strlen(f->filename) + strlen(f->realfilename) + 15;   cmd = alloca(size);   memset(cmd,0,size);   snprintf(cmd,size,"/bin/mv -f %s %s",f->filename,f->realfilename);   ast_safe_system(cmd); with simpler, safer and faster:   ast_file_rename(f->filename,f->realfilename);
Comments:	By: nick gavrikov (nick gavrikov) 2006-09-18 02:59:54 patch updated to current trunk By: nick gavrikov (nick gavrikov) 2006-09-18 03:09:40 I'm not sure about last patch with vfork(). It needs more investigations. Do not use file Alast.diff I will upload different patch later. By: jmls (jmls) 2006-11-01 06:18:11.000-0600 Nick Gavrikov, any further thoughts on this ? By: nick gavrikov (nick gavrikov) 2006-11-02 01:21:05.000-0600 I will update patch to current trunk but now I have no working asterisk for tests. By: nick gavrikov (nick gavrikov) 2006-11-02 08:06:56.000-0600 patch updated to current trunk. Please test it before use!!! By: Denis Smirnov (mithraen) 2006-11-09 11:05:16.000-0600 Please, update this patch with recent changes to app_voicemail. By: nick gavrikov (nick gavrikov) 2006-11-10 04:22:39.000-0600 patch updated to current trunk. Please test it before use!!! By: Olle Johansson (oej) 2007-02-11 12:50:39.000-0600 To have both ast_filecopy and ast_file_copy is way too confusing. Also please check formatting so it follows coding guidelines (see file.c changes as an example). By: nick gavrikov (nick gavrikov) 2007-02-12 07:32:41.000-0600 Suggest your name for function that would copy files, please. By: Serge Vecher (serge-v) 2007-03-30 10:09:26 Nick: I think the point that OEJ was trying to make is that you need to reuse the existing ast_copy[rename] functions, modifying them if necessary for your needs, instead of adding new functions. By: Russell Bryant (russell) 2007-05-11 14:06:54 The code in this patch looks pretty good.  However, the formatting still needs to be fixed to match our guidelines before it can be merged. By: Russell Bryant (russell) 2007-06-01 16:01:36 This issue has been suspended pending code updates to match our guidelines.