← All KD5FMU repositories

Saytime-Weather-TimeFormat-ASL3

https://github.com/KD5FMU/Saytime-Weather-TimeFormat-ASL3 · Shell/Perl · 2 findings · Review date 2026-07-11

Executive Summary

Generally better hardened than 2026 variant but still downloads voice assets over HTTP.

Top-of-the-hour spoken time and current weather conditions for AllStarLink 3 on Debian 12 Bookworm and Debian 13 Trixie.

Summary Counts

0
Critical Security
0
High Security
2
Medium Security
0
Low Security
0
Critical Bugs
0
High Bugs
0
Medium Bugs
0
Low Bugs

Quick Reference

IDSeverityCategoryFileLinesFinding
SAYTIME-TF-001 Medium Security install_asl3_saytime_weather_timeformat.sh 108-112 Sound files downloaded over HTTP without verification
SAYTIME-TF-002 Medium Security bin/saytime.pl 72-73 saytime.pl invokes shell for cat concatenation

Medium Issues

[SAYTIME-TF-001] Sound files downloaded over HTTP without verification

install_asl3_saytime_weather_timeformat.sh : 108-112

curl sound_files.zip from http://198.58.124.150/tw/.

Impact: Tampered archive replaces on-air voice prompts.

[SAYTIME-TF-002] saytime.pl invokes shell for cat concatenation

bin/saytime.pl : 72-73

Builds cat command string and passes to system($cat).

Impact: Unexpected paths with metacharacters could execute shell.

Recommended Fix Priority

  1. Use HTTPS with checksum verification for remote downloads