Latest News About Asterisk » Security Advisories

Asterisk 1.4.43, 1.6.2.21, and 1.8.7.2 Now Available (Security Release)

admin — Thu, 08 Dec 2011 13:18:56 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced security releases for Asterisk 1.4, 1.6.2 and 1.8. The available security releases are released as versions 1.4.43, 1.6.2.21 and 1.8.7.2.

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The release of Asterisk versions 1.4.43, 1.6.2.21, and 1.8.7.2 resolves an issue with possible remote enumeration of SIP endpoints with differing NAT settings.

The release of Asterisk versions 1.6.2.21 and 1.8.7.2 resolves a remote crash possibility with SIP when the “automon” feature is enabled.

The issues and resolutions are described in the AST-2011-013 and AST-2011-014 security advisories.

For more information about the details of these vulnerabilities, please read the security advisories AST-2011-013 and AST-2011-014, which were released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLogs:

Security advisory AST-2011-013 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-013.pdf

Security advisory AST-2011-014 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-014.pdf

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk Security Advisories – AST-2011-013: Possible remote enumeration of SIP endpoints with differing NAT settings

admin — Thu, 08 Dec 2011 04:07:51 +0000

Asterisk Project Security Advisory - AST-2011-013

Product	Asterisk
Summary	Possible remote enumeration of SIP endpoints with differing NAT settings
Nature of Advisory	Unauthorized data disclosure
Susceptibility	Remote unauthenticated sessions
Severity	Minor
Exploits Known	Yes
Reported On	2011-07-18
Reported By	Ben Williams
Posted On
Last Updated On	December 8, 2011
Advisory Contact	Terry Wilson
CVE Name

Description

It is possible to enumerate SIP usernames when the general and user/peer NAT settings differ in whether to respond to the port a request is sent from or the port listed for responses in the Via header. In 1.4 and 1.6.2, this would mean if one setting was nat=yes or nat=route and the other was either nat=no or nat=never. In 1.8 and 10, this would mean when one was nat=force_rport or nat=yes and the other was nat=no or nat=comedia.

Resolution

Handling NAT for SIP over UDP requires the differing behavior introduced by these options.

To lessen the frequency of unintended username disclosure, the default NAT setting was changed to always respond to the port from which we received the request—the most commonly used option.

Warnings were added on startup to inform administrators of the risks of having a SIP peer configured with a different setting than that of the general setting. The documentation now strongly suggests that peers are no longer configured for NAT individually, but through the global setting in the “general” context.

For a discussion of the reasons behind this change and why no general fix is provided, please see the mailing list discussion referenced in the “Links” section below.

Affected Versions
Product	Release Series
Asterisk Open Source	All	All versions

Corrected In

As this is more of an issue with SIP over UDP in general, there is no fix supplied other than documentation on how to avoid the problem. The default NAT setting has been changed to what we believe the most commonly used setting for the respective version in Asterisk 1.4.43, 1.6.2.21, and 1.8.7.2.

Links

http://lists.digium.com/pipermail/asterisk-dev/2011-November/052191.html

Asterisk Project Security Advisories are posted at http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2011-013.pdf and http://downloads.digium.com/pub/security/AST-2011-013.html

Revision History
Date	Editor	Revisions Made

Share and Enjoy:

Asterisk Security Advisories – AST-2011-014: Remote crash possibility with SIP and the “automon” feature enabled

admin — Wed, 07 Dec 2011 04:58:33 +0000

Asterisk Project Security Advisory - AST-2011-014

Product	Asterisk
Summary	Remote crash possibility with SIP and the “automon” feature enabled
Nature of Advisory	Remote crash vulnerability in a feature that is disabled by default
Susceptibility	Remote unauthenticated sessions
Severity	Moderate
Exploits Known	Yes
Reported On	November 2, 2011
Reported By	Kristijan Vrban
Posted On	2011-11-03
Last Updated On	December 7, 2011
Advisory Contact	Terry Wilson
CVE Name

Description

When the “automon” feature is enabled in features.conf, it is possible to send a sequence of SIP requests that cause Asterisk to dereference a NULL pointer and crash.

Resolution

Applying the referenced patches that check that the pointer is not NULL before accessing it will resolve the issue. The “automon” feature can be disabled in features.conf as a workaround.

Affected Versions
Product	Release Series
Asterisk Open Source	1.6.2.x	All versions
Asterisk Open Source	1.8.x	All versions

Corrected In
Product	Release
Asterisk Open Source	1.6.2.21, 1.8.7.2

Patches
Download URL	Revision
http://downloads.asterisk.org/pub/security/AST-2011-014-1.6.2.diff	1.6.2.20
http://downloads.asterisk.org/pub/security/AST-2011-014-1.8.diff	1.8.7.1

Links

Asterisk Project Security Advisories are posted at http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2011-014.pdf and http://downloads.digium.com/pub/security/AST-2011-014.html

Revision History
Date	Editor	Revisions Made

Share and Enjoy:

Asterisk Security Advisories – AST-2011-012: Remote crash vulnerability in SIP channel driver

admin — Mon, 17 Oct 2011 08:40:40 +0000

Asterisk Project Security Advisory – AST-2011-012

Product	Asterisk
Summary	Remote crash vulnerability in SIP channel driver
Nature of Advisory	Remote crash
Susceptibility	Remote authenticated sessions
Severity	Critical
Exploits Known	No
Reported On	October 4, 2011
Reported By	Ehsan Foroughi
Posted On	October 17, 2011
Last Updated On	October 17, 2011
Advisory Contact	Terry Wilson
CVE Name	CVE-2011-4063

Description

A remote authenticated user can
cause a crash with a malformed request due to an unitialized
variable.

Resolution

Ensure variables are initialized
in all cases when parsing the request.

Affected Versions
Product	Release Series
Asterisk Open Source	1.8.x	All versions
Asterisk Open Source	10.x	All versions (currently in beta)

Corrected In
Product	Release
Asterisk Open Source	1.8.7.1, 10.0.0-rc1

Patches
Download URL	Revision
http://downloads.asterisk.org/pub/security/AST-2011-012-1.8.diff	1.8
http://downloads.asterisk.org/pub/security/AST-2011-012-10.diff	10

Links

Asterisk Project Security Advisories are posted
at http://www.asterisk.org/security

This document may be superseded by later
versions; if so, the latest version will be posted at

http://downloads.digium.com/pub/security/AST-2011-012.pdf

and http://downloads.digium.com/pub/security/AST-2011-012.html

Revision History
Date	Editor	Revisions Made

Share and Enjoy:

Asterisk 1.8.7.1 now available (Security Release)

admin — Mon, 17 Oct 2011 08:35:44 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced a security release for Asterisk 1.8.
The available security release is released as version 1.8.7.1.

This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The release of Asterisk 1.8.7.1 resolves an issue with SIP URI parsing which can lead to a remotely exploitable crash:

Remote Crash Vulnerability in SIP channel driver (AST-2011-012)

The issue and resolution is described in the AST-2011-012 security advisory.

For more information about the details of this vulnerability, please read the security advisory AST-2011-012, which was released at the same time as this announcement.

For a full list of changes in the current release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.7.1

Security advisory AST-2011-012 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-012.pdf

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk 1.4.41.2, Asterisk 1.6.2.18.2, Asterisk 1.8.4.4 Now Available (Security Release)

admin — Tue, 28 Jun 2011 11:00:33 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced the release of Asterisk versions 1.4.41.2, 1.6.2.18.2, and 1.8.4.4, which are security releases.

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The release of Asterisk 1.4.41.2, 1.6.2.18.2, and 1.8.4.4 resolves the following issue:

AST-2011-011: Asterisk may respond differently to SIP requests from an invalid SIP user than it does to a user configured on the system, even when the alwaysauthreject option is set in the configuration. This can leak information about what SIP users are valid on the Asterisk system.

For more information about the details of this vulnerability, please read the security advisory AST-2011-011, which was released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLog:

Security advisory AST-2011-011 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-011.pdf

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk Security Advisories – AST-2011-011: Possible enumeration of SIP users due to differing authentication responses

admin — Tue, 28 Jun 2011 10:57:27 +0000

Asterisk Project Security Advisory - AST-2011-011

Product	Asterisk
Summary	Possible enumeration of SIP users due to differing authentication responses
Nature of Advisory	Unauthorized data disclosure
Susceptibility	Remote unauthenticated sessions
Severity	Moderate
Exploits Known	No
Reported On	June 11, 2011
Reported By
Posted On	June 28, 2011
Last Updated On	June 28, 2011
Advisory Contact	Terry Wilson
CVE Name	CVE-2011-2536

Description

Asterisk may respond differently to SIP requests from an invalid SIP user than it does to a user configured on the system, even when the alwaysauthreject option is set in the configuration. This can leak information about what SIP users are valid on the Asterisk system.

Resolution

Respond to SIP requests from invalid and valid SIP users in the same way. Asterisk 1.4 and 1.6.2 do not respond identically by default due to backward-compatibility reasons, and must have alwaysauthreject=yes set in sip.conf. Asterisk 1.8 defaults to alwaysauthreject=yes.

IT IS ABSOLUTELY IMPERATIVE that users of Asterisk 1.4 and 1.6.2 set alwaysauthreject=yes in the general section of sip.conf.

Affected Versions
Product	Release Series
Asterisk Open Source	1.4.x	All versions
Asterisk Open Source	1.6.2.x	All versions
Asterisk Open Source	1.8.x	All versions
Asterisk Business Edition	C.3.x	All versions

Corrected In
Product	Release
Asterisk Open Source	1.4.41.2, 1.6.2.18.2, 1.8.4.4
Asterisk Business Edition	C.3.7.3

Patches
Download URL	Revision
http://downloads.asterisk.org/pub/security/AST-2011-011-1.4.diff	1.4
http://downloads.asterisk.org/pub/security/AST-2011-011-1.6.2.diff	1.6.2
http://downloads.asterisk.org/pub/security/AST-2011-011-1.8.diff	1.8

Links

Asterisk Project Security Advisories are posted at http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2011-011.pdf and http://downloads.digium.com/pub/security/AST-2011-011.html

Revision History
Date	Editor	Revisions Made

Share and Enjoy:

Asterisk 1.4.39.2, Asterisk 1.6.1.22, Asterisk 1.6.2.16.2 and Asterisk 1.8.2.4 Now Available

admin — Tue, 22 Feb 2011 12:02:04 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced security releases for Asterisk branches 1.4, 1.6.1, 1.6.2, and 1.8. The available security releases are released as versions 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and 1.8.2.4.

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The releases of Asterisk 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and 1.8.2.4 resolve an issue that when decoding UDPTL packets, multiple stack and heap based arrays can be made to overflow by specially crafted packets. Systems doing T.38 pass through or termination are vulnerable. The issue and resolution are described in the AST-2011-002 security advisory.

For more information about the details of this vulnerability, please read the security advisory AST-2011-002, which was released at the same time as this announcement.

For a full list of changes in the current release, please see the ChangeLog:

Security advisory AST-2011-002 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-002.pdf

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk Security Advisory – AST-2011-002: Multiple array overflow and crash vulnerabilities in UDPTL code

admin — Mon, 21 Feb 2011 20:45:39 +0000

Product	Asterisk
Summary	Multiple array overflow and crash vulnerabilities in UDPTL code
Nature of Advisory	Exploitable Stack and Heap Array Overflows
Susceptibility	Remote Unauthenticated Sessions
Severity	Critical
Exploits Known	No
Reported On	January 27, 2011
Reported By	Matthew Nicholson
Posted On	February 21, 2011
Last Updated On	February 22, 2011
Advisory Contact	Matthew Nicholson
CVE Name

Description

When decoding UDPTL packets, multiple stack and heap based arrays can be made to overflow by specially crafted packets. Systems configured for T.38 pass through or termination are vulnerable.

Resolution

The UDPTL decoding routines have been modified to respect the limits of exploitable arrays.

In asterisk versions not containing the fix for this issue, disabling T.38 support will prevent this vulnerability from being exploited. T.38 support can be disabled in chan_sip by setting the t38pt_udptl option to “no” (it is off by default).

t38pt_udptl = no

The chan_ooh323 module should also be disabled by adding the following line in modles.conf.

noload => chan_ooh323

Affected Versions
Product	Release Series
Asterisk Open Source	1.4.x	All versions
Asterisk Open Source	1.6.x	All versions
Asterisk Business Edition	C.x.x	All versions
AsteriskNOW	1.5	All versions
s800i (Asterisk Appliance)	1.2.x	All versions

Corrected In
Product	Release
Asterisk Open Source	1.4.39.2, 1.6.1.22, 1.6.2.16.2, 1.8.2.4
Asterisk Business Edition	C.3.6.3

Patches
URL	Branch
http://downloads.asterisk.org/pub/security/AST-2011-002-1.4.diff	1.4
http://downloads.asterisk.org/pub/security/AST-2011-002-1.6.1.diff	1.6.1
http://downloads.asterisk.org/pub/security/AST-2011-002-1.6.2.diff	1.6.2
http://downloads.asterisk.org/pub/security/AST-2011-002-1.8.diff	1.8

Links

Asterisk Project Security Advisories are posted at http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2011-002.pdf and http://downloads.digium.com/pub/security/AST-2011-002.html

Revision History
Date	Editor	Revisions Made
02/21/11	Matthew Nicholson	Initial Release
02/22/11	Matthew Nicholson	Changed some wording

Share and Enjoy:

Asterisk 1.8.2.2 Now Available (Security Release)

admin — Thu, 20 Jan 2011 11:20:44 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced a release for the security issue described in AST-2011-001.

Due to a failed merge, Asterisk 1.8.2.1 which should have included the security fix did not. Asterisk 1.8.2.2 contains the the changes which should have been included in Asterisk 1.8.2.1.

This releases is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.2, 1.8.1.2, and 1.8.2.2 resolve an issue when forming an outgoing SIP request while in pedantic mode, which can cause a stack buffer to be made to overflow if supplied with carefully crafted caller ID information. The issue and resolution are described in the AST-2011-001 security advisory.

For more information about the details of this vulnerability, please read the security advisory AST-2011-001, which was released at the same time as this announcement.

For a full list of changes in the current release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…

Security advisory AST-2011-001 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-001.pdf

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk Security Releases: AST-2011-001

admin — Tue, 18 Jan 2011 06:40:30 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced security releases for the following versions of Asterisk:

1.4.38.1
1.4.39.1
1.6.1.21
1.6.2.15.1
1.6.2.16.1
1.8.1.2
1.8.2.1

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.2, 1.8.1.2, and 1.8.2.1 resolve an issue when forming an outgoing SIP request while in pedantic mode, which can cause a stack buffer to be made to overflow if supplied with carefully crafted caller ID information. The issue and resolution are described in the AST-2011-001 security advisory.

For more information about the details of this vulnerability, please read the security advisory AST-2011-001, which was released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…

Security advisory AST-2011-001 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-001.pdf

Thank you for your continued support of Asterisk!

Share and Enjoy:

AST-2011-001: Stack buffer overflow in SIP channel driver

admin — Tue, 11 Jan 2011 06:40:12 +0000

Asterisk Project Security Advisory - AST-2011-001

Product	Asterisk
Summary	Stack buffer overflow in SIP channel driver
Nature of Advisory	Exploitable Stack Buffer Overflow
Susceptibility	Remote Authenticated Sessions
Severity	Moderate
Exploits Known	No
Reported On	January 11, 2011
Reported By	Matthew Nicholson
Posted On	January 18, 2011
Last Updated On	January 20, 2011
Advisory Contact	Matthew Nicholson
CVE Name	CVE-2011-0495

Description

When forming an outgoing SIP request while in pedantic mode, a stack buffer can be made to overflow if supplied with carefully crafted caller ID information. This vulnerability also affects the URIENCODE dialplan function and in some versions of asterisk, the AGI dialplan application as well. The ast_uri_encode function does not properly respect the size of its output buffer and can write past the end of it when encoding URIs.

Resolution

The size of the output buffer passed to the ast_uri_encode function is now properly respected.

In asterisk versions not containing the fix for this issue, limiting strings originating from remote sources that will be URI encoded to a length of 40 characters will protect against this vulnerability.

exten => s,1,Set(CALLERID(num)=${CALLERID(num):0:40})
exten => s,n,Set(CALLERID(name)=${CALLERID(name):0:40})
exten => s,n,Dial(SIP/channel)

The CALLERID(num) and CALLERID(name) channel values, and any strings passed to the URIENCODE dialplan function should be limited in this manner.

Affected Versions
Product	Release Series
Asterisk Open Source	1.2.x	All versions
Asterisk Open Source	1.4.x	All versions
Asterisk Open Source	1.6.x	All versions
Asterisk Open Source	1.8.x	All versions
Asterisk Business Edition	C.x.x	All versions
AsteriskNOW	1.5	All versions
s800i (Asterisk Appliance)	1.2.x	All versions

Corrected In
Product	Release
Asterisk Open Source	1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.2
Asterisk Business Edition	C.3.6.2

Patches
URL	Branch
http://downloads.asterisk.org/pub/security/AST-2011-001-1.4.diff	1.4
http://downloads.asterisk.org/pub/security/AST-2011-001-1.6.1.diff	1.6.1
http://downloads.asterisk.org/pub/security/AST-2011-001-1.6.2.diff	1.6.2
http://downloads.asterisk.org/pub/security/AST-2011-001-1.8.diff	1.8

Asterisk Project Security Advisories are posted at http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2011-001.pdf and http://downloads.digium.com/pub/security/AST-2011-001.html

Revision History
Date	Editor	Revisions Made
2011-01-18	Matthew Nicholson	Initial Release
2011-01-19	Matthew Nicholson	Added CVE Name
2011-01-20	Matthew Nicholson	Changed 1.8.2.1 to 1.8.2.2 for fix versions

Share and Enjoy:

Asterisk Security Advisory – AST-2010-001: T.38 Remote Crash Vulnerability

admin — Tue, 02 Feb 2010 21:40:39 +0000

Asterisk The Open Source PBX & Telephony Platform

Asterisk Project Security Advisory - AST-2010-001

Product	Asterisk
Summary	T.38 Remote Crash Vulnerability
Nature of Advisory	Denial of Service
Susceptibility	Remote unauthenticated sessions
Severity	Critical
Exploits Known	No
Reported On	12/03/09
Reported By	issues.asterisk.org users bklang and elsto
Posted On	02/03/10
Last Updated On	February 2, 2010
Advisory Contact	David Vossel < dvossel AT digium DOT com >
CVE Name	CVE-2010-0441

Description

An attacker attempting to negotiate T.38 over SIP can remotely crash Asterisk by modifying the FaxMaxDatagram field of the SDP to contain either a negative or exceptionally large value. The same crash occurs when the FaxMaxDatagram field is omitted from the SDP as well.

Resolution

Upgrade to one of the versions of Asterisk listed in the “Corrected In” section, or apply a patch specified in the “Patches” section.

Affected Versions
Product	Release Series
Asterisk Open Source	1.6.x	All versions
Asterisk Business Edition	C.3	All versions

Corrected In
Product	Release
Asterisk Open Source	1.6.0.22
Asterisk Open Source	1.6.1.14
Asterisk Open Source	1.6.2.2
	C.3.3.2

Patches
SVN URL	Branch
http://downloads.asterisk.org/pub/security/AST-2010-001-1.6.0.diff	v1.6.0
http://downloads.asterisk.org/pub/security/AST-2010-001-1.6.1.diff	v1.6.1
http://downloads.asterisk.org/pub/security/AST-2010-001-1.6.2.diff	v1.6.2

Links

https://issues.asterisk.org/view.php?id=16634

https://issues.asterisk.org/view.php?id=16724

https://issues.asterisk.org/view.php?id=16517

Asterisk Project Security Advisory are posted at http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/.pdf and http://downloads.digium.com/pub/security/.html

Revision History
Date	Editor	Revisions Made
02/02/10	David Vossel	Initial release

Asterisk Project Security Advisory - AST-2010-001

Share and Enjoy:

Asterisk 1.6.0.22, Asterisk 1.6.1.14, Asterisk 1.6.2.2 Released

admin — Tue, 02 Feb 2010 21:28:10 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced security releases for Asterisk as the following versions:

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The releases of Asterisk 1.6.0.22, 1.6.1.14, and 1.6.2.2 include the fix described in security advisory AST-2010-001.

The issue is that an attacker attempting to negotiate T.38 over SIP can remotely crash Asterisk by modifying the FaxMaxDatagram field of the SDP to contain either a negative or exceptionally large value. The same crash will occur when the FaxMaxDatagram field is omitted from the SDP, as well.

For more information about the details of this vulnerability, please read the security advisory AST-2010-001, which was released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLog:

Security advisory AST-2010-001 is available at:
http://asterisk.net.ru/en/2010/02/03/asterisk-security-advisory-ast-2010-001-t-38-remote-crash-vulnerability/

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk Security Advisory – AST-2009-005: Remote Crash Vulnerability in SIP channel driver

admin — Tue, 11 Aug 2009 14:00:42 +0000

Asterisk The Open Source PBX & Telephony Platform

Note that while this potential vulnerability has existed in Asterisk for a very long time, it is only potentially exploitable in 1.6.1 and above, since those versions are the first that have allowed SIP packets to exceed 1500 bytes total, which does not permit strings that are large enough to crash Asterisk. (The number strings presented to us by the security researcher were approximately 32,000 bytes long.)

Additionally note that while this can crash Asterisk, execution of arbitrary code is not possible with this vector.

Upgrade Asterisk to one of the releases listed below.

Asterisk Project Security Advisory – AST-2009-005

Product	Asterisk
Summary	Remote Crash Vulnerability in SIP channel driver
Nature of Advisory	Denial of Service
Susceptibility	Remote Unauthenticated Sessions
Severity	Critical in 1.6.1; minor in lesser versions
Exploits Known	No
Reported On	July 28, 2009
Reported By	Nick Baggott < nbaggott AT mudynamics DOT com >
Posted On	August 10, 2009
Last Updated On	August 10, 2009
Advisory Contact	Tilghman Lesher < tlesher AT digium DOT com >
CVE Name	CVE-2009-2726

Description

On certain implementations of libc, the scanf family of functions uses an unbounded amount of stack memory to repeatedly allocate string buffers prior to conversion to the target type. Coupled with Asterisk‘s allocation of thread stack sizes that are smaller than the default, an attacker may exhaust stack memory in the SIP stack network thread by presenting excessively long numeric strings in various fields. Note that while this potential vulnerability has existed in Asterisk for a very long time, it is only potentially exploitable in 1.6.1 and above, since those versions are the first that have allowed SIP packets to exceed 1500 bytes total, which does not permit strings that are large enough to crash Asterisk. (The number strings presented to us by the security researcher were approximately 32,000 bytes long.)

Additionally note that while this can crash Asterisk, execution of arbitrary code is not possible with this vector.

Resolution

Upgrade Asterisk to one of the releases listed below.

Affected Versions
Product	Release Series
Asterisk Open Source	1.2.x	All versions prior to 1.2.34
Asterisk Open Source	1.4.x	All versions prior to 1.4.26.1
Asterisk Open Source	1.6.0.x	All versions prior to 1.6.0.12
Asterisk Open Source	1.6.1.x	All versions prior to 1.6.1.4
Asterisk Addons	1.2.x	Not affected
Asterisk Addons	1.4.x	Not affected
Asterisk Addons	1.6.0.x	Not affected
Asterisk Addons	1.6.1.x	Not affected
Asterisk Business Edition	A.x.x	All versions
Asterisk Business Edition	B.x.x	All versions prior to B.2.5.9
Asterisk Business Edition	C.2.x	All versions prior to C.2.4.1
Asterisk Business Edition	C.3.x	All versions prior to C.3.1
AsteriskNOW	1.5	Not affected
s800i (Asterisk Appliance)	1.2.x	All versions prior to 1.3.0.3

Corrected In
Product	Release
Asterisk Open Source	1.2.34
Asterisk Open Source	1.4.26.1
Asterisk Open Source	1.6.0.12
Asterisk Open Source	1.6.1.4
Asterisk Business Edition	B.2.5.9
Asterisk Business Edition	C.2.4.1
Asterisk Business Edition	C.3.1
s800i (Asterisk Appliance)	1.3.0.3

Patches
Link	Branch
http://downloads.digium.com/pub/security/AST-2009-005-1.2.diff.txt	1.2
http://downloads.digium.com/pub/security/AST-2009-005-1.4.diff.txt	1.4
http://downloads.digium.com/pub/security/AST-2009-005-trunk.diff.txt	trunk
http://downloads.digium.com/pub/security/AST-2009-005-1.6.0.diff.txt	1.6.0
http://downloads.digium.com/pub/security/AST-2009-005-1.6.1.diff.txt	1.6.1
http://downloads.digium.com/pub/security/AST-2009-005-1.6.2.diff.txt	1.6.2