Link Down :-)
 
i thaks if somebody create one wiki witch this alert
 
 
Eng Eder de Souza

On Mon, Feb 22, 2010 at 2:39 PM, Eder Souza <ederwander@gmail.com> wrote:

yeah can somebody make one wiki for this alert??

 
im make down my link page now to prevent thes problems !!
 
OK

On Mon, Feb 22, 2010 at 2:26 PM, Giovanni Maruzzelli <gmaruzz@celliax.org> wrote:
Eder,

If you fear people can do such *really stupid* things, and this is
nice from you, please add something to the wiki, for example a
paragraph in the dialplan page, or whatever, explaining why this is a
stupid thing.

If you publish a page in your blog, that look like a security alert,
or that you found a security flaw in FS, people will rightly think
that you are just looking for some attention in the search engines,
and to bring viewers to your page.

Also, in doing so, you push non technical people to think there is a
security problem in FS, and this is really a big damage to the
project. Because it is not true, it is just how it look like in your
page.

So, delete that page, and add something to the wiki, if you care about
telling people not to do stupid things.

But please, be aware that your page, the page you published, is really
something that do a damage and put a bad light on a project, and there
is no one reason for doing this.

-giovanni



On Mon, Feb 22, 2010 at 6:09 PM, Eder Souza <ederwander@gmail.com> wrote:
> i prefer FreeSwitch im left Asterisk
>
> FreeSwitch is Very Very betther then Asterisk in my option !!
>
>
> my intention is just say dont use (.*), (.+)  or combinations of this
> regular expressions, for me FreeSwitch is the betther  !!
>
>
>
> On Mon, Feb 22, 2010 at 1:47 PM, Anthony Minessale
> <anthony.minessale@gmail.com> wrote:
>>
>> To me it sounds like a way to sound the alarms and bring negative
>> attention.
>>
>> For instance, if you were sincerely concerned, you could have told us
>> about your discovery privately first, and we could feature a story on our
>> own site warning people of this danger and reminding them how to compose
>> extension properly.
>>
>> The posting was instead made like a big public announcement calling our
>> software "imperfect".
>> Yes it is imperfect, It can't properly detect someone being a moron 100%
>> of the time but it sure tries it's darndest.
>>
>>
>>
>>
>> On Mon, Feb 22, 2010 at 10:33 AM, Eder Souza <ederwander@gmail.com> wrote:
>>>
>>> Antony i dont see why ??
>>>
>>>
>>> this is just one alert for all comunity of danger in the use of regular
>>> expression (.*) or (.*) ...
>>>
>>> many peoples can make dialplans witch use of this expressions ...
>>>
>>>
>>>
>>>
>>>
>>> On Mon, Feb 22, 2010 at 1:19 PM, Anthony Minessale
>>> <anthony.minessale@gmail.com> wrote:
>>>>
>>>> Please do not use our project to try to make your blog more popular.
>>>>
>>>> Your example requires you to prepare an intentional specific extension
>>>> on the FreeSWITCH custom made for your attack. It’s like saying if you leave
>>>> your door wide open at your house and call and tell someone, they can come
>>>> and rob you at 8:30.
>>>>
>>>> This extension is also vulnerable “by virtue of the stupidity of the
>>>> composer”
>>>>
>>>> <extension name=”please-hack-me”/>
>>>>   <condition>
>>>>    <action application=”system” data=”${destination_number}”/>
>>>>   </condition>
>>>> </extension>
>>>>
>>>> You should not allow tainted data from outside system to be fed directly
>>>> into your code. There is a regex system in place to extract legitimate data
>>>> from the user tainted input and safeguard against this.
>>>>
>>>>
>>>>
>>>> On Mon, Feb 22, 2010 at 9:58 AM, Eder Souza <ederwander@gmail.com>
>>>> wrote:
>>>>>
>>>>>
>>>>> http://ederwander.wordpress.com/2010/02/22/dial-string-inject-in-freeswitch/
>>>>>
>>>>> just for yours informations i write this article my test for injections
>>>>> in freesitch
>>>>>
>>>>> version of my tests
>>>>>
>>>>> freeswitch@internal> version
>>>>> FreeSWITCH Version 1.0.5-20100218-0400 (hacked)
>>>>> freeswitch@internal>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> FreeSWITCH-users mailing list
>>>>> FreeSWITCH-users@lists.freeswitch.org
>>>>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>>>>>
>>>>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>>>>> http://www.freeswitch.org
>>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> Anthony Minessale II
>>>>
>>>> FreeSWITCH http://www.freeswitch.org/
>>>> ClueCon http://www.cluecon.com/
>>>> Twitter: http://twitter.com/FreeSWITCH_wire
>>>>
>>>> AIM: anthm
>>>> MSN:anthony_minessale@hotmail.com
>>>> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com
>>>> IRC: irc.freenode.net #freeswitch
>>>>
>>>> FreeSWITCH Developer Conference
>>>> sip:888@conference.freeswitch.org
>>>> iax:guest@conference.freeswitch.org/888
>>>> googletalk:conf+888@conference.freeswitch.org
>>>> pstn:+19193869900
>>>>
>>>> _______________________________________________
>>>> FreeSWITCH-users mailing list
>>>> FreeSWITCH-users@lists.freeswitch.org
>>>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>>>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>>>> http://www.freeswitch.org
>>>>
>>>
>>>
>>> _______________________________________________
>>> FreeSWITCH-users mailing list
>>> FreeSWITCH-users@lists.freeswitch.org
>>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>>> http://www.freeswitch.org
>>>
>>
>>
>>
>> --
>> Anthony Minessale II
>>
>> FreeSWITCH http://www.freeswitch.org/
>> ClueCon http://www.cluecon.com/
>> Twitter: http://twitter.com/FreeSWITCH_wire
>>
>> AIM: anthm
>> MSN:anthony_minessale@hotmail.com
>> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com
>> IRC: irc.freenode.net #freeswitch
>>
>> FreeSWITCH Developer Conference
>> sip:888@conference.freeswitch.org
>> iax:guest@conference.freeswitch.org/888
>> googletalk:conf+888@conference.freeswitch.org
>> pstn:+19193869900
>>
>> _______________________________________________
>> FreeSWITCH-users mailing list
>> FreeSWITCH-users@lists.freeswitch.org
>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>> http://www.freeswitch.org
>>
>
>
> _______________________________________________
> FreeSWITCH-users mailing list
> FreeSWITCH-users@lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
>



--
Sincerely,

Giovanni Maruzzelli
Cell : +39-347-2665618