kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-04 03:50:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Don't crash if a manager connection provides a username that exists in

Browse Source 
manager.conf but does not have a password, and also requests MD5 
authentication. (ASA-2007-012)


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.2@61786 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Russell Bryant
2007-04-24 21:33:59 +00:00
parent 1cde24d633
commit c5a87ff71d
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
manager.c
View File

@@ -533,7 +533,8 @@ static int authenticate(struct mansession *s, struct message *m)
} else if (ha)
ast_free_ha(ha);
if (!strcasecmp(authtype, "MD5")) {
if (!ast_strlen_zero(key) && s->challenge) {
if (!ast_strlen_zero(key) &&
!ast_strlen_zero(s->challenge) && !ast_strlen_zero(password)) {
int x;
int len=0;
char md5key[256] = "";