[VOIPSEC] Trixbox Arbitrary Command Execution Vulnerability
thanrantaro at live.com
Sat Dec 15 23:41:41 EST 2007
set of scripts were recently discovered in the trixbox line of PBX
products, which connect to a remote host every 24 hours, to retrieve an arbitrary
list of commands to be executed locally. These scripts were added
under the guise of submitting 'anonymous usage statistics', however,
with the help of DNS pollution, or malice on the part of the sponsoring
company (Fonality), all up-to-date versions of trixbox could be
instantly disabled, or worse.
According to trixbox Community
Director, Kerry Gerrison, a new version of trixbox will be available by
December 18th which will allow you to 'opt-out' (meaning that it will
still be enabled by default) of this behavior.
Don't get caught with egg on your face. Play Chicktionary!
More information about the Voipsec