Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2011.0672.2
A number of vulnerabilities have been identified in Asterisk
7 July 2011
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Asterisk
Publisher: Asterisk
Operating System: UNIX variants (UNIX, Linux, OSX)
Impact/Access: Denial of Service -- Remote/Unauthenticated
Unauthorised Access -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2011-2665 CVE-2011-2535 CVE-2011-2529
Original Bulletin:
http://downloads.asterisk.org/pub/security/AST-2011-008.html
http://downloads.asterisk.org/pub/security/AST-2011-009.html
http://downloads.asterisk.org/pub/security/AST-2011-010.html
Comment: This bulletin contains three (3) Asterisk security advisories.
Revision History: July 7 2011: Added CVE reference
June 27 2011: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
Product
Asterisk
Summary
Remote Crash Vulnerability in SIP channel driver
Nature of Advisory
Remote attacker can crash an Asterisk server
Susceptibility
Remote Unauthenticated Sessions
Severity
Critical
Exploits Known
Yes
Reported On
06/15/2011
Reported By
Paul Belanger pabelanger@digium.com
Posted On
06/20/2011
Last Updated On
June 16, 2011
Advisory Contact
Kinsey Moore kmoore@digium.com
CVE Name
CVE-2011-2529
Description
If a remote user sends a SIP packet containing a null, Asterisk assumes
available data extends past the null to the end of the packet when the buffer
is actually truncated when copied. This causes SIP header parsing to modify
data past the end of the buffer altering unrelated memory structures. This
vulnerability does not affect TCP/TLS connections.
Resolution
Asterisk now uses the correct length when dealing with SIP packets containing
nulls. Available workarounds are to disable chan_sip or to upgrade.
Affected Versions
Product Release Series
Asterisk Open Source 1.6.0.x All
Asterisk Open Source 1.6.1.x All
Asterisk Open Source 1.6.2.x All
Asterisk Open Source 1.8.x All
Corrected In
Product Release
Asterisk Open Source 1.6.2.x 1.6.2.18.1
Asterisk Open Source 1.8.x 1.8.4.3
Patches
URL Branch
Http://downloads.asterisk.org/pub/security/AST-2011-008.diff 1.6.2, 1.8
Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security
This document may be superseded by later versions; if so, the latest version
will be posted at http://downloads.digium.com/pub/security/AST-2011-008.pdf
and http://downloads.digium.com/pub/security/AST-2011-008.html
Revision History Date Editor
Revisions Made 06/20/2011 Kinsey Moore
Initial Release
- -------------------------------------------------------------------------------
Product
Asterisk
Summary
Remote Crash Vulnerability in SIP channel driver
Nature of Advisory
Remote attacker can crash an Asterisk server
Susceptibility
Remote Unauthenticated Sessions
Severity
Critical
Exploits Known
Yes
Reported On
06/13/2011
Reported By
jaredmauch
Posted On
06/23/2011
Last Updated On
June 23, 2011
Advisory Contact
Paul Belanger pabelanger@digium.com
CVE Name CVE Requested
Description
A remote user sending a SIP packet containing a Contact header with a missing
left angle bracket (<) causes Asterisk to access a null pointer.
Resolution
Asterisk now warns the user of the missing bracket and continues processing.
Available workarounds are to disable chan_sip or to upgrade.
Affected Versions
Product Release Series
Asterisk Open Source 1.8.x All
Corrected In
Product Release
Asterisk Open Source 1.8.x 1.8.4.3
Patches
SVN URL Revision
Http://downloads.asterisk.org/pub/security/AST-2011-009.diff 1.8
Asterisk Project Security Advisories are posted at http://www.asterisk.org/security
This document may be superseded by later versions; if so, the latest version
will be posted at http://downloads.digium.com/pub/security/AST-2011-009.pdf
and http://downloads.digium.com/pub/security/AST-2011-009.html
Revision History
Date Editor Revisions Made
06/20/2011 Kinsey Moore Initial Release
- -------------------------------------------------------------------------------
Asterisk Project Security Advisory - AST-2011-010
Product
Asterisk
Summary
Remote crash vulnerability in IAX2 channel driver
Nature of Advisory
Remote crash
Susceptibility
Remote unauthenticated sessions
Severity
Moderate
Exploits Known
No
Reported On
June 1, 2011
Reported By
Posted On
June 22, 2011
Last Updated On
June 22, 2011
Advisory Contact
Terry Wilson <twilson@digium.com>
CVE Name
CVE-2011-2535
Description
A memory address was inadvertently transmitted over the network via IAX2 via
an option control frame and the remote party would try to access it.
Resolution
The default behavior is to no longer transmit all option control frame data
across an IAX2 link, but only what is specifically useful to send. The option
that was passed is also no longer read via the network if it is sent.
Affected Versions
Product Release Series
Asterisk Open Source 1.4.x 1.4.37+
Asterisk Open Source 1.6.2.x 1.6.2.15+
Asterisk Open Source 1.8.x All versions
Asterisk Business Edition C.3 C.3.6+
Corrected In
Product Release
Asterisk Open Source 1.4.41.1, 1.6.2.18.1, 1.8.4.3
Asterisk Business Edition C.3.7.3
Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2011-010-1.4.diff 1.4
http://downloads.asterisk.org/pub/security/AST-2011-010-1.6.2.diff 1.6.2
http://downloads.asterisk.org/pub/security/AST-2011-010-1.8.diff 1.8
Links
Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security
This document may be superseded by later versions; if so, the latest version
will be posted at http://downloads.digium.com/pub/security/AST-2011-010.pdf and
http://downloads.digium.com/pub/security/AST-2011-010.html
Revision History
Date Editor Revisions Made
Asterisk Project Security Advisory - AST-2011-010
Copyright 2011 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBThUzpu4yVqjM2NGpAQL2sg/+O4x9HY9tNiTlMRZjRUKxu5qmNdEOcTeF
pPCbyD8iA/4I1Soo5nj5ewUfx8pAwGtPMUlXSK8Vvnw70gG2nJO/tX7d9ydIz3Zk
V7sJebYJU9V9GyQY3UMSbP+miuW6rgT52phGWQ/Rx4Jz2/FsvVH5NxPaCI1YU+EG
YfmmTBgR+QGyYvAUWKscTWeOGVSyG7xettCy9K+c195AW4pChg11l8ztoFKvX2gU
gM73/mEoETb70czTkXIohMT6K2Vj+QGWjx2P28vfbawRJxNQc515FDQ2HN5D6ubw
+8rvQ6BkvI2IHvOj9Ynr1O90kpmDM3rbQH18p3pCjytExrLv9AF1pCDuLdVXy6bb
IqAw4vpfas43+KpxHMLfiBDnjuZj/PDUwQ0NOeAD4uoU9sPTvM+gjL4FQybS3qnE
aYrsEbfpo0Ua+NpMZf/n9E5oB1mkY399NuMV0z6qjvyR0AWr5gxrcm0wuR6dXQDI
jZT26aCyR46Z4uOBSGUS+OVM6fynFhgmCAJHirJKsXk9dWS+XFvLrsnlvNSg+jBF
+ZL0ojxL4H3fBgP8THPWFkjbv33+CSpauclZKafi55t35ZA2SBZtaGGyCQhEaMaH
YKg+y956zm3+gtEXPNKpbNrbf6moYV0RRjlYn0q4HqMuqTTDjF/DTuJSrUlGRjgH
zD5fH8SWXBI=
=N1gx
-----END PGP SIGNATURE-----