Bug#338116: asterisk-web-vmail: Information disclosure of voice mail messages through vmail.cgi

[Moritz Muehlenhoff]

Package: asterisk-web-vmail
Version: 1:1.0.9.dfsg-5
Severity: important
Tags: security

 vmail.cgi doesn't clean a parameter passed by the web user which is
 later used to open a file and return a raw stream to the user.
 This allows any authenticated user of the voicemail system to listen to
 other peoples messages, or to open any file with the extension .wav/.WAV
 on the system.

For more information please see
http://www.assurance.com.au/advisories/200511-asterisk.txt

Cheers,
        Moritz

-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.14-1-686
Locale: LANG=C, LC_CTYPE=de_DE.ISO-8859-15 at euro (charmap=ISO-8859-15)