Asterisk Recording Interface contains a flaw that allows a remote attacker to access other user's voice mail. The issue is due to the '/recordings/misc/audio.php' script not properly sanitizing user input, specifically directory traversal style attacks (../../) supplied via the 'recording' variable. This may lead to a loss of confidentiality of '.mp3', '.wav' and '.gsm' voice mail messages. In addition, attackers might be able to determine the existence of files of other files within the remote file system.
Remote / Network Access
Loss of Confidentiality
Upgrade to version 0.10.00 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.