Asterisk Project Security Advisory – AST-2011-006

Asterisk Project Security Advisory – It is possible for a user of the Asterisk Manager Interface to bypass a security check and execute shell commands when they should not have that ability. Sending the « Async » header with the « Application » header during an Originate action, allows authenticated manager users to execute shell commands. Only users with the « system » privilege should be able to do this.

Source: Asterisk Project Security Advisory – AST-2011-006