Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2012.0650 Asterisk Project Security Advisory - AST-2012-010 9 July 2012 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Asterisk Publisher: Digium Operating System: UNIX variants (UNIX, Linux, OSX) Windows Impact/Access: Denial of Service -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2012-3863 Original Bulletin: http://downloads.asterisk.org/pub/security/AST-2012-010.txt - --------------------------BEGIN INCLUDED TEXT-------------------- Asterisk Project Security Advisory - AST-2012-010 Product Asterisk Summary Possible resource leak on uncompleted re-invite transactions Nature of Advisory Denial of Service Susceptibility Remote authenticated sessions Severity Minor Exploits Known No Reported On June 13, 2012 Reported By Steve Davies Posted On July 5, 2012 Last Updated On July 6, 2012 Advisory Contact Terry Wilson <twilson@digium.com> CVE Name CVE-2012-3863 Description If Asterisk sends a re-invite and an endpoint responds to the re-invite with a provisional response but never sends a final response, then the SIP dialog structure is never freed and the RTP ports for the call are never released. If an attacker has the ability to place a call, they could create a denial of service by using all available RTP ports. Resolution A re-invite that receives a provisional response without a final response is detected and properly cleaned up at hangup. Affected Versions Product Release Series Asterisk Open Source 1.8.x All versions Asterisk Open Source 10.x All versions Asterisk Business Edition C.3.x All versions Certified Asterisk 1.8.11-certx All versions Asterisk Digiumphones 10.x.x-digiumphones All versions Corrected In Product Release Asterisk Open Source 1.8.13.1, 10.5.2 Asterisk Business Edition C.3.7.5 Certified Asterisk 1.8.11-cert4 Asterisk Digiumphones 10.5.2-digiumphones Patches URL Revision http://downloads.asterisk.org/pub/security/AST-2012-010-1.8.diff Asterisk 1.8 http://downloads.asterisk.org/pub/security/AST-2012-010-10.diff Asterisk 10 Links https://issues.asterisk.org/jira/browse/ASTERISK-19992 Asterisk Project Security Advisories are posted at http://www.asterisk.org/security This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2012-010.pdf and http://downloads.digium.com/pub/security/AST-2012-010.html Revision History Date Editor Revisions Made 06/27/2012 Terry Wilson Initial Release 07/06/2012 Matt Jordan Added CVE Asterisk Project Security Advisory - AST-2012-010 Copyright (c) 2012 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBT/pHYO4yVqjM2NGpAQJC0Q//Wsf4rThVhV+EjEeWwPUYOaDNVUK1Ans6 bd3WtkXrcqlxr2sZktDWd+0hhpqxTmYTVHaqugi7xrzdmV494DxMv4FcbuS5k++6 09YMpJLskPpYeVXpmWhtJdrGPQv8JIngGuQ3vSzyrlLCGcU3YYcoIT4b0LI2DXj1 R5O2w8xDdJSiFjEZj9I3URGldAxFJRaVKvvXsnVFM6U+qO4k/M9FVEkL/8+dHrZQ IFK8ek1mnpC5v0IHJnY6/996YVnm1ha8sLbluXjpQ48rfzjlcUniqICqHB2tCCu+ p/MJlZHsrUae6G4JrzZVyOek+kz0KR7vl1QjIt0cLOrzP75hyhYbC+8C8aquwwls 4Rs9QWeQkRkbkSYkXsV18LqBLGPJuZg3ZWQj72Giu+TRddtpNBQhWZ4PCAArgb1e ye7kH6/97HQczNLq2G6swYmRUqmlY7jSXf3386OuwsfzovHzb38Tp/AcNtqV5BLX EeLt0ZyVxWPCKSL7SNQ93rBEAP/WpsICXOXvF83U3eJ3kPlL29JVutN16IH9xAew O/e9tbQpuhSGOj7r7QmYYub9p0bjH1DGsA68vYg/U4xp3AQposEaKB2UaPKl478q TI6ukjmLPsRupkJVt9KFCvkIWTc5xlY+zKM7OD/C9t701VRw9SI0mv9z/QM5EZJ5 2jID0lMWT3Q= =eECQ -----END PGP SIGNATURE-----