If you have any FreePBX machines floating around, now is the time to make sure they're up to date, ESPECIALLY if they're visible from the interwebs.
https://www.reddit.com/r/VOIP/comments/dypp36/20191119_critical_freepbx_security_vulnerability/ I backdated it for those yanks who are living in the past, but it was discovered this morning. The quick summary is it's a trivial exploit, with the ability to escalate to a root shell - which means a pwned machine, all the attacker needs is unauthenticated visibility to any of the admin pages. Feel free to hit me up offlist if you need any more info. And yes, it was my code that was vulnerable, but in my defence it was 12 year old code, and the vulnerability was only just discovered now 8) --Rob
_______________________________________________ AusNOG mailing list AusNOG@lists.ausnog.net http://lists.ausnog.net/mailman/listinfo/ausnog
