Latest News About Asterisk » Security Advisories

Asterisk Security Advisory – AST-2010-001: T.38 Remote Crash Vulnerability

admin — Tue, 02 Feb 2010 21:40:39 +0000

Asterisk The Open Source PBX & Telephony Platform

Asterisk Project Security Advisory - AST-2010-001

Product	Asterisk
Summary	T.38 Remote Crash Vulnerability
Nature of Advisory	Denial of Service
Susceptibility	Remote unauthenticated sessions
Severity	Critical
Exploits Known	No
Reported On	12/03/09
Reported By	issues.asterisk.org users bklang and elsto
Posted On	02/03/10
Last Updated On	February 2, 2010
Advisory Contact	David Vossel < dvossel AT digium DOT com >
CVE Name	CVE-2010-0441

Description

An attacker attempting to negotiate T.38 over SIP can remotely crash Asterisk by modifying the FaxMaxDatagram field of the SDP to contain either a negative or exceptionally large value. The same crash occurs when the FaxMaxDatagram field is omitted from the SDP as well.

Resolution

Upgrade to one of the versions of Asterisk listed in the “Corrected In” section, or apply a patch specified in the “Patches” section.

Affected Versions
Product	Release Series
Asterisk Open Source	1.6.x	All versions
Asterisk Business Edition	C.3	All versions

Corrected In
Product	Release
Asterisk Open Source	1.6.0.22
Asterisk Open Source	1.6.1.14
Asterisk Open Source	1.6.2.2
	C.3.3.2

Patches
SVN URL	Branch
http://downloads.asterisk.org/pub/security/AST-2010-001-1.6.0.diff	v1.6.0
http://downloads.asterisk.org/pub/security/AST-2010-001-1.6.1.diff	v1.6.1
http://downloads.asterisk.org/pub/security/AST-2010-001-1.6.2.diff	v1.6.2

Links

https://issues.asterisk.org/view.php?id=16634

https://issues.asterisk.org/view.php?id=16724

https://issues.asterisk.org/view.php?id=16517

Asterisk Project Security Advisory are posted at http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/.pdf and http://downloads.digium.com/pub/security/.html

Revision History
Date	Editor	Revisions Made
02/02/10	David Vossel	Initial release

Asterisk Project Security Advisory - AST-2010-001

Share and Enjoy:

Asterisk 1.6.0.22, Asterisk 1.6.1.14, Asterisk 1.6.2.2 Released

admin — Tue, 02 Feb 2010 21:28:10 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced security releases for Asterisk as the following versions:

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The releases of Asterisk 1.6.0.22, 1.6.1.14, and 1.6.2.2 include the fix described in security advisory AST-2010-001.

The issue is that an attacker attempting to negotiate T.38 over SIP can remotely crash Asterisk by modifying the FaxMaxDatagram field of the SDP to contain either a negative or exceptionally large value. The same crash will occur when the FaxMaxDatagram field is omitted from the SDP, as well.

For more information about the details of this vulnerability, please read the security advisory AST-2010-001, which was released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLog:

Security advisory AST-2010-001 is available at:
http://asterisk.net.ru/en/2010/02/03/asterisk-security-advisory-ast-2010-001-t-38-remote-crash-vulnerability/

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk Security Advisory – AST-2009-005: Remote Crash Vulnerability in SIP channel driver

admin — Tue, 11 Aug 2009 14:00:42 +0000

Asterisk The Open Source PBX & Telephony Platform

Note that while this potential vulnerability has existed in Asterisk for a very long time, it is only potentially exploitable in 1.6.1 and above, since those versions are the first that have allowed SIP packets to exceed 1500 bytes total, which does not permit strings that are large enough to crash Asterisk. (The number strings presented to us by the security researcher were approximately 32,000 bytes long.)

Additionally note that while this can crash Asterisk, execution of arbitrary code is not possible with this vector.

Upgrade Asterisk to one of the releases listed below.

Asterisk Project Security Advisory – AST-2009-005

Product	Asterisk
Summary	Remote Crash Vulnerability in SIP channel driver
Nature of Advisory	Denial of Service
Susceptibility	Remote Unauthenticated Sessions
Severity	Critical in 1.6.1; minor in lesser versions
Exploits Known	No
Reported On	July 28, 2009
Reported By	Nick Baggott < nbaggott AT mudynamics DOT com >
Posted On	August 10, 2009
Last Updated On	August 10, 2009
Advisory Contact	Tilghman Lesher < tlesher AT digium DOT com >
CVE Name	CVE-2009-2726

Description

On certain implementations of libc, the scanf family of functions uses an unbounded amount of stack memory to repeatedly allocate string buffers prior to conversion to the target type. Coupled with Asterisk‘s allocation of thread stack sizes that are smaller than the default, an attacker may exhaust stack memory in the SIP stack network thread by presenting excessively long numeric strings in various fields. Note that while this potential vulnerability has existed in Asterisk for a very long time, it is only potentially exploitable in 1.6.1 and above, since those versions are the first that have allowed SIP packets to exceed 1500 bytes total, which does not permit strings that are large enough to crash Asterisk. (The number strings presented to us by the security researcher were approximately 32,000 bytes long.)

Additionally note that while this can crash Asterisk, execution of arbitrary code is not possible with this vector.

Resolution

Upgrade Asterisk to one of the releases listed below.

Affected Versions
Product	Release Series
Asterisk Open Source	1.2.x	All versions prior to 1.2.34
Asterisk Open Source	1.4.x	All versions prior to 1.4.26.1
Asterisk Open Source	1.6.0.x	All versions prior to 1.6.0.12
Asterisk Open Source	1.6.1.x	All versions prior to 1.6.1.4
Asterisk Addons	1.2.x	Not affected
Asterisk Addons	1.4.x	Not affected
Asterisk Addons	1.6.0.x	Not affected
Asterisk Addons	1.6.1.x	Not affected
Asterisk Business Edition	A.x.x	All versions
Asterisk Business Edition	B.x.x	All versions prior to B.2.5.9
Asterisk Business Edition	C.2.x	All versions prior to C.2.4.1
Asterisk Business Edition	C.3.x	All versions prior to C.3.1
AsteriskNOW	1.5	Not affected
s800i (Asterisk Appliance)	1.2.x	All versions prior to 1.3.0.3

Corrected In
Product	Release
Asterisk Open Source	1.2.34
Asterisk Open Source	1.4.26.1
Asterisk Open Source	1.6.0.12
Asterisk Open Source	1.6.1.4
Asterisk Business Edition	B.2.5.9
Asterisk Business Edition	C.2.4.1
Asterisk Business Edition	C.3.1
s800i (Asterisk Appliance)	1.3.0.3

Patches
Link	Branch
http://downloads.digium.com/pub/security/AST-2009-005-1.2.diff.txt	1.2
http://downloads.digium.com/pub/security/AST-2009-005-1.4.diff.txt	1.4
http://downloads.digium.com/pub/security/AST-2009-005-trunk.diff.txt	trunk
http://downloads.digium.com/pub/security/AST-2009-005-1.6.0.diff.txt	1.6.0
http://downloads.digium.com/pub/security/AST-2009-005-1.6.1.diff.txt	1.6.1
http://downloads.digium.com/pub/security/AST-2009-005-1.6.2.diff.txt	1.6.2

Links

http://labs.mudynamics.com/advisories/MU-200908-01.txt

Asterisk Project Security Advisories are posted at http://www.asterisk.org/securityThis document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2009-005.pdf and http://downloads.digium.com/pub/security/AST-2009-005.html

Revision History
Date	Editor	Revisions Made
August 10, 2009	Tilghman Lesher	Initial release

Asterisk Project Security Advisory – AST-2009-005

News in the mail list asterisk-security:

http://lists.digium.com/pipermail/asterisk-security/2009-August/000310.html

News in the mail list asterisk-announce:

http://lists.digium.com/pipermail/asterisk-announce/2009-August/000201.html

News in the mail list asterisk-users:

http://lists.digium.com/pipermail/asterisk-users/2009-August/236008.html

News in the mail list asterisk-dev:

http://lists.digium.com/pipermail/asterisk-dev/2009-August/039301.html

Share and Enjoy:

Asterisk 1.2.34, Asterisk 1.4.26.1, Asterisk 1.6.0.13, and Asterisk 1.6.1.4 released

admin — Tue, 11 Aug 2009 08:18:53 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team is pleased to announce the releases of 1.2.34, 1.4.26.1, 1.6.0.13, and 1.6.1.4. These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The release of 1.6.1.4 fixes a remote crash security vulnerability in the SIP stack. Although this crash was not demonstrated in any other version, the details of the vulnerability suggested the possibility that related attacks might be possible in the future. We therefore opted to release new versions of all current releases with these fixes applied. For more information about the details of this vulnerability, please read the security advisory AST-2009-005, which was released at the same time as this announcement.

In addition, Asterisk users may notice that we skipped the version numbers 1.6.0.11 and 1.6.1.3. This was intentional, in an effort to avoid confusion about what a particular release contains. Both of those version numbers had candidates for releases made, so backtracking on those changes in a release with the same version number might be confusing. Those release candidates will be reissued with additional bugfixes, as 1.6.0.14-rc1 and 1.6.1.5-rc1, respectively.

For a full list of changes in the current releases, please see the ChangeLogs:
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.2.34
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.4.26.1
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.0.13
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.1.4

Thank you for your continued support of Asterisk!

News in the list asterisk-users:

http://lists.digium.com/pipermail/asterisk-users/2009-August/236007.html

News in the list asterisk-dev:

http://lists.digium.com/pipermail/asterisk-dev/2009-August/039300.html

News in the list asterisk-announce:

http://lists.digium.com/pipermail/asterisk-announce/2009-August/000200.html

News in the list asterisk-security:

http://lists.digium.com/pipermail/asterisk-security/2009-August/000309.html

Share and Enjoy:

Asterisk Security Advisory – AST-2009-004

admin — Mon, 03 Aug 2009 14:04:17 +0000

Asterisk The Open Source PBX & Telephony Platform

Asterisk Project Security Advisory – AST-2009-004

An attacker can cause Asterisk to crash remotely by sending malformed RTP text frames. While the attacker can cause Asterisk to crash, he cannot execute arbitrary remote code with this exploit.
Users should upgrade to a version listed in the “Corrected In” section below.

Product	Asterisk
Summary	Remote Crash Vulnerability in RTP stack
Nature of Advisory	Exploitable Crash
Susceptibility	Remote unauthenticated sessions
Severity	Critical
Exploits Known	No
Reported On	July 27, 2009
Reported By	Marcus Hunger
Posted On	August 2, 2009
Last Updated On	August 2, 2009
Advisory Contact	Mark Michelson
CVE Name

Description

An attacker can cause Asterisk to crash remotely by sending malformed RTP text frames. While the attacker can cause Asterisk to crash, he cannot execute arbitrary remote code with this exploit.

Resolution

Users should upgrade to a version listed in the “Corrected In” section below.

Affected Versions
Product	Release Series
Asterisk Open Source	1.2.x	Unaffected
Asterisk Open Source	1.4.x	Unaffected
Asterisk Open Source	1.6.x	All 1.6.1 versions
Asterisk Addons	1.2.x	Unaffected
Asterisk Addons	1.4.x	Unaffected
Asterisk Addons	1.6.x	Unaffected
Asterisk Business Edition	A.x.x	Unaffected
Asterisk Business Edition	B.x.x	Unaffected
Asterisk Business Edition	C.x.x	Unaffected
AsteriskNOW	1.5	Unaffected
s800i (Asterisk Appliance)	1.2.x	Unaffected

Corrected In
Product	Release
Open Source Asterisk 1.6.1	1.6.1.2

Patches
SVN URL	Version
http://downloads.digium.com/pub/security/AST-2009-004-1.6.1.diff.txt	1.6.1

Links

Asterisk Project Security Advisories are posted at http://www.asterisk.org/security. This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2009-004.pdf and http://downloads.digium.com/pub/security/AST-2009-004.html

Revision History
Date	Editor	Revisions Made
27 Jul, 2009	Mark Michelson	Initial Draft
31 Jul, 2009	Mark Michelson	Added sentence about how remote code cannot be executed.
August 2, 2009	Tilghman Lesher	Public release

Asterisk Project Security Advisory – AST-2009-004

News in the mail list asterisk-security:

http://lists.digium.com/pipermail/asterisk-security/2009-August/000308.html

News in the mail list asterisk-announce:

http://lists.digium.com/pipermail/asterisk-announce/2009-August/000199.html

News in the mail list asterisk-users:

http://lists.digium.com/pipermail/asterisk-users/2009-August/235653.html

News in the mail list asterisk-dev:

http://lists.digium.com/pipermail/asterisk-dev/2009-August/039244.html

Share and Enjoy:

Asterisk 1.6.0.11-rc2, 1.6.1.2, 1.6.1.3-rc1, and 1.6.2.0-beta4 Release Announcement

admin — Mon, 03 Aug 2009 03:50:23 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team is pleased to announce the the second release candidate of 1.6.0.11, the release of 1.6.1.2, the first release candidate of 1.6.1.3, and the fourth beta of 1.6.2.0. These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/.

The release of 1.6.1.2 fixes a remote crash security vulnerability in the RTP stack. The related security advisory AST-2009-004 has been released along with this announcement. Please read that advisory for more information.

The release candidates and betas, in addition to other fixes, contain a major re-work of the T.38 support in Asterisk. If you’ve been having trouble with T.38 in the 1.6 series, you are strongly encouraged to try one of these release candidates to determine if these changes fixed your T.38 issues.

For a full list of changes in these releases, please see the ChangeLogs:
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.0.11-rc2
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.1.2
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.1.3-rc1
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.6.2.0-beta4

Thank you for your continued support of Asterisk!

News in the list asterisk-users:

http://lists.digium.com/pipermail/asterisk-users/2009-August/235651.html

News in the list asterisk-dev:

http://lists.digium.com/pipermail/asterisk-dev/2009-August/039243.html

News in the list asterisk-announce:

http://lists.digium.com/pipermail/asterisk-announce/2009-August/000198.html

News in the list asterisk-security:

http://lists.digium.com/pipermail/asterisk-security/2009-August/000307.html

Share and Enjoy: