[VOIPSEC] Trixbox Arbitrary Command Execution Vulnerability

Than Taro thanrantaro at live.com
Sat Dec 15 22:41:41 CST 2007

set of scripts were recently discovered in the trixbox line of PBX
products, which connect to a remote host every 24 hours, to retrieve an arbitrary
list of commands to be executed locally.  These scripts were added
under the guise of submitting 'anonymous usage statistics', however,
with the help of DNS pollution, or malice on the part of the sponsoring
company (Fonality), all up-to-date versions of trixbox could be
instantly disabled, or worse.

According to trixbox Community
Director, Kerry Gerrison, a new version of trixbox will be available by
December 18th which will allow you to 'opt-out' (meaning that it will
still be enabled by default) of this behavior.

Further details:

Don't get caught with egg on your face. Play Chicktionary!

More information about the Voipsec mailing list