Latest News About Asterisk » Asterisk Security Releases

Asterisk 1.4.43, 1.6.2.21, and 1.8.7.2 Now Available (Security Release)

admin — Thu, 08 Dec 2011 13:18:56 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced security releases for Asterisk 1.4, 1.6.2 and 1.8. The available security releases are released as versions 1.4.43, 1.6.2.21 and 1.8.7.2.

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The release of Asterisk versions 1.4.43, 1.6.2.21, and 1.8.7.2 resolves an issue with possible remote enumeration of SIP endpoints with differing NAT settings.

The release of Asterisk versions 1.6.2.21 and 1.8.7.2 resolves a remote crash possibility with SIP when the “automon” feature is enabled.

The issues and resolutions are described in the AST-2011-013 and AST-2011-014 security advisories.

For more information about the details of these vulnerabilities, please read the security advisories AST-2011-013 and AST-2011-014, which were released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLogs:

Security advisory AST-2011-013 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-013.pdf

Security advisory AST-2011-014 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-014.pdf

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk Security Advisories – AST-2011-012: Remote crash vulnerability in SIP channel driver

admin — Mon, 17 Oct 2011 08:40:40 +0000

Asterisk Project Security Advisory – AST-2011-012

Product	Asterisk
Summary	Remote crash vulnerability in SIP channel driver
Nature of Advisory	Remote crash
Susceptibility	Remote authenticated sessions
Severity	Critical
Exploits Known	No
Reported On	October 4, 2011
Reported By	Ehsan Foroughi
Posted On	October 17, 2011
Last Updated On	October 17, 2011
Advisory Contact	Terry Wilson
CVE Name	CVE-2011-4063

Description

A remote authenticated user can
cause a crash with a malformed request due to an unitialized
variable.

Resolution

Ensure variables are initialized
in all cases when parsing the request.

Affected Versions
Product	Release Series
Asterisk Open Source	1.8.x	All versions
Asterisk Open Source	10.x	All versions (currently in beta)

Corrected In
Product	Release
Asterisk Open Source	1.8.7.1, 10.0.0-rc1

Patches
Download URL	Revision
http://downloads.asterisk.org/pub/security/AST-2011-012-1.8.diff	1.8
http://downloads.asterisk.org/pub/security/AST-2011-012-10.diff	10

Links

Asterisk Project Security Advisories are posted
at http://www.asterisk.org/security

This document may be superseded by later
versions; if so, the latest version will be posted at

http://downloads.digium.com/pub/security/AST-2011-012.pdf

and http://downloads.digium.com/pub/security/AST-2011-012.html

Revision History
Date	Editor	Revisions Made

Share and Enjoy:

Asterisk 1.8.7.1 now available (Security Release)

admin — Mon, 17 Oct 2011 08:35:44 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced a security release for Asterisk 1.8.
The available security release is released as version 1.8.7.1.

This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The release of Asterisk 1.8.7.1 resolves an issue with SIP URI parsing which can lead to a remotely exploitable crash:

Remote Crash Vulnerability in SIP channel driver (AST-2011-012)

The issue and resolution is described in the AST-2011-012 security advisory.

For more information about the details of this vulnerability, please read the security advisory AST-2011-012, which was released at the same time as this announcement.

For a full list of changes in the current release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.7.1

Security advisory AST-2011-012 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-012.pdf

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk 1.4.41.2, Asterisk 1.6.2.18.2, Asterisk 1.8.4.4 Now Available (Security Release)

admin — Tue, 28 Jun 2011 11:00:33 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced the release of Asterisk versions 1.4.41.2, 1.6.2.18.2, and 1.8.4.4, which are security releases.

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The release of Asterisk 1.4.41.2, 1.6.2.18.2, and 1.8.4.4 resolves the following issue:

AST-2011-011: Asterisk may respond differently to SIP requests from an invalid SIP user than it does to a user configured on the system, even when the alwaysauthreject option is set in the configuration. This can leak information about what SIP users are valid on the Asterisk system.

For more information about the details of this vulnerability, please read the security advisory AST-2011-011, which was released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLog:

Security advisory AST-2011-011 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-011.pdf

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk 1.4.39.2, Asterisk 1.6.1.22, Asterisk 1.6.2.16.2 and Asterisk 1.8.2.4 Now Available

admin — Tue, 22 Feb 2011 12:02:04 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced security releases for Asterisk branches 1.4, 1.6.1, 1.6.2, and 1.8. The available security releases are released as versions 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and 1.8.2.4.

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The releases of Asterisk 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and 1.8.2.4 resolve an issue that when decoding UDPTL packets, multiple stack and heap based arrays can be made to overflow by specially crafted packets. Systems doing T.38 pass through or termination are vulnerable. The issue and resolution are described in the AST-2011-002 security advisory.

For more information about the details of this vulnerability, please read the security advisory AST-2011-002, which was released at the same time as this announcement.

For a full list of changes in the current release, please see the ChangeLog:

Security advisory AST-2011-002 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-002.pdf

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk 1.8.2.2 Now Available (Security Release)

admin — Thu, 20 Jan 2011 11:20:44 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced a release for the security issue described in AST-2011-001.

Due to a failed merge, Asterisk 1.8.2.1 which should have included the security fix did not. Asterisk 1.8.2.2 contains the the changes which should have been included in Asterisk 1.8.2.1.

This releases is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.2, 1.8.1.2, and 1.8.2.2 resolve an issue when forming an outgoing SIP request while in pedantic mode, which can cause a stack buffer to be made to overflow if supplied with carefully crafted caller ID information. The issue and resolution are described in the AST-2011-001 security advisory.

For more information about the details of this vulnerability, please read the security advisory AST-2011-001, which was released at the same time as this announcement.

For a full list of changes in the current release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…

Security advisory AST-2011-001 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-001.pdf

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk Security Releases: AST-2011-001

admin — Tue, 18 Jan 2011 06:40:30 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced security releases for the following versions of Asterisk:

1.4.38.1
1.4.39.1
1.6.1.21
1.6.2.15.1
1.6.2.16.1
1.8.1.2
1.8.2.1

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.2, 1.8.1.2, and 1.8.2.1 resolve an issue when forming an outgoing SIP request while in pedantic mode, which can cause a stack buffer to be made to overflow if supplied with carefully crafted caller ID information. The issue and resolution are described in the AST-2011-001 security advisory.

For more information about the details of this vulnerability, please read the security advisory AST-2011-001, which was released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…

Security advisory AST-2011-001 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-001.pdf

Thank you for your continued support of Asterisk!

Share and Enjoy: