Full Disclosure mailing list archives
Trixbox CE - undocumented web admin
From: "Tim Osman" <timosman () email com>
Date: Sat, 12 Mar 2011 23:07:33 +0000
Affected products: ------------------------- Trixbox CE 2.8.0.4 and below Trixbox CE 2.6.2.3 and below ---------- Details: ---------- Trixbox CE, an Asterisk and FreePBX based system ships with undocumented web admin. The admin web interface can be accessed by user wwwadmin which grants full access to PBX configuration including all trunks/extensions credentials and config changes. ---------- Solution: ---------- Remove wwwadmin from /usr/local/apache/passwd/wwwpasswd and/or /etc/trixbox/httpdconf/trixbox.conf ------------ Timeline: ------------ 08/20/2010 Notification posted on trixbox.org 11/29/2010 Vendor acknowledged and scheduled fix for the next release. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Trixbox CE - undocumented web admin Tim Osman (Mar 12)