FYI Incredible PBX Security Audit Results

[wardmundy]

Today on Nerd Vittles:

Security 101: A Fresh Look at Incredible PBX Security Audit Methodology

 

[chris_c_]

Today on Nerd Vittles:

Security 101: A Fresh Look at Incredible PBX Security Audit Methodology

I tried this out just now, and immediately found another couple of bugs in two shell script files, which pertain to this iptables feature.
The shell script code, which is supposed to detect when a failure occurs, fails to detect that failure!
I fixed these bugs on the github repository, so if you'd like to see for yourself, it's up there and open to anyone

 

[wardmundy]

I tried this out just now, and immediately found another couple of bugs in two shell script files, which pertain to this iptables feature.
The shell script code, which is supposed to detect when a failure occurs, fails to detect that failure!
I fixed these bugs on the github repository, so if you'd like to see for yourself, it's up there and open to anyone

Sorry. Don't know where "the github repository" is. Is there documentation identifying where the bugs are and how they are addressed? If so, we'll be happy to have a look.

 

[chris_c_]

Sorry. Don't know where "the github repository" is. Is there documentation identifying where the bugs are and how they are addressed? If so, we'll be happy to have a look.

https://github.com/EspaceNetworks/I...mmit/4589b4a50e9392cef01ee9ba2aca45f572a53ff2

 

[wardmundy]

Thanks. The add-ip issue had already been addressed. We've also fixed a problem in del-acct as well. You might want to freshen your repo. Appreciate your help though.

 

[chris_c_]

Thanks. The add-ip issue had already been addressed. We've also fixed a problem in del-acct as well. You might want to freshen your repo. Appreciate your help though.

You missed the bug, and the fix. Look again, a little more closely.

EDIT: Your code logic for the iptables restart was always coming up as a false positive ie "no failure" even when the iptables restart did indeed fail...