<![CDATA[Pickup security hole in multi tenanted environment]]>Hi

We are using version 2.26 in a multi tenanted environment. If user A clicks the call pickup button when there is no call coming in for that customer, it picks up a random call from another customer on the server. As you can appreciate that this is a serious security issue.

Can anyone try to replicate this to and see if it is a genuine bug?

]]>http://localhost:4567/topic/1683/pickup-security-hole-in-multi-tenanted-environmentRSS for NodeTue, 27 Oct 2026 15:01:09 GMTTue, 07 Jan 2014 14:50:16 GMT60<![CDATA[Reply to Pickup security hole in multi tenanted environment on Wed, 08 Jan 2014 13:03:40 GMT]]>Here is an excerpt from fop2.cfg, you will have to use the option that is more appropiate for your scenario/asterisk version:

; Call pickup uses the pickupmark variable by default. In multi tenant
; systems this might lead to problems as you might end un picking up
; some other tenant call. In that case you might want to try to 
; pickup the call by its context uncomenting the following line:
;
; no_pickupmark=1

; If your asterisk version supports the pickupchan application it is 
; much better to use this than the regular pickup application as it will
; be directed towards the channel and not the extension, makeing it
; more precise.
;
; use_pickupchan=1
]]>http://localhost:4567/post/7274http://localhost:4567/post/7274Wed, 08 Jan 2014 13:03:40 GMT