The following issue was made public in the AST-2014-017 advisory [1][2]:

The CONFBRIDGE dialplan function when executed from an external protocol
(for instance AMI), could result in a privilege escalation. Also, the AMI
action "ConfbridgeStartRecord" could also be used to execute arbitrary
system commands without first checking for system access.

Patches for this issue are linked to in the AST-2014-017 [1][2] advisory.

References:
[1] http://downloads.asterisk.org/pub/security/AST-2014-017.pdf
[2] http://seclists.org/fulldisclosure/2014/Nov/70