Asterisk Recording Interface contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an attacker requests the configuration file '/recordings/includes/main.conf' directly, as there are no controls to prevent such access. This will disclose the application's configuration information, including administrative and database passwords, resulting in a loss of confidentiality.
Classification
Location:
Remote / Network Access
Attack Type:
Information Disclosure
Impact:
Loss of Confidentiality
Exploit:
Exploit Public
OSVDB:
Web Related
Solution
Upgrade to version 0.10.00 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
securiweb.net -
SecuriWeb
