Bug#420864: [asteriskteam@digium.com: [asterisk-announce] ASA-2007-011: Multiple problems in SIP channel parser handling response codes]

Mark Purcell mark at purcell.id.au
Wed Apr 25 05:32:27 UTC 2007


Package: asterisk
Version: 1:1.4.2~dfsg-4
Severity: important

----- Forwarded message from Asterisk Development Team <asteriskteam at digium.com> -----

Envelope-to: mark at purcell.id.au
From: Asterisk Development Team <asteriskteam at digium.com>
Organization: Digium, Inc.
To: undisclosed-recipients: ;
Subject: [asterisk-announce] ASA-2007-011: Multiple problems in SIP channel
 parser handling response codes
X-BeenThere: asterisk-announce at lists.digium.com
X-Mailman-Version: 2.1.5
List-Id: asterisk-announce.lists.digium.com
List-Unsubscribe: <http://lists.digium.com/mailman/listinfo/asterisk-announce>, 
	<mailto:asterisk-announce-request at lists.digium.com?subject=unsubscribe>
List-Archive: <http://lists.digium.com/pipermail/asterisk-announce>
List-Post: <mailto:asterisk-announce at lists.digium.com>
List-Help: <mailto:asterisk-announce-request at lists.digium.com?subject=help>
List-Subscribe: <http://lists.digium.com/mailman/listinfo/asterisk-announce>, 
	<mailto:asterisk-announce-request at lists.digium.com?subject=subscribe>

>                Asterisk Project Security Advisory - ASA-2007-011
> 
>    +------------------------------------------------------------------------+
>    |      Product       | Asterisk                                          |
>    |--------------------+---------------------------------------------------|
>    |      Summary       | Multiple problems in SIP channel parser handling  |
>    |                    | response codes                                    |
>    |--------------------+---------------------------------------------------|
>    | Nature of Advisory | Denial of Service                                 |
>    |--------------------+---------------------------------------------------|
>    |   Susceptibility   | Remote Unauthenticated Sessions                   |
>    |--------------------+---------------------------------------------------|
>    |      Severity      | Critical                                          |
>    |--------------------+---------------------------------------------------|
>    |   Exploits Known   | No                                                |
>    |--------------------+---------------------------------------------------|
>    |    Reported On     | March 20, 2007                                    |
>    |--------------------+---------------------------------------------------|
>    |    Reported By     | Mantis user ID 'qwerty1979'                       |
>    |--------------------+---------------------------------------------------|
>    |     Posted On      | April 24, 2007                                    |
>    |--------------------+---------------------------------------------------|
>    |  Last Updated On   | April 24, 2007                                    |
>    |--------------------+---------------------------------------------------|
>    |  Advisory Contact  | kpfleming at digium.com                              |
>    +------------------------------------------------------------------------+
> 
>    +------------------------------------------------------------------------+
>    | Description | Multiple problems have been identified in the Asterisk   |
>    |             | SIP channel driver (chan_sip) when handling response     |
>    |             | packets from other SIP endpoints.                        |
>    |             |                                                          |
>    |             | If the response packets did not contain a valid response |
>    |             | code in the first line of the UDP packet, the Asterisk   |
>    |             | SIP channel driver would fail to parse the packet        |
>    |             | properly and would cause the Asterisk process to die     |
>    |             | with a segmentation fault. This results in all active    |
>    |             | calls and other sessions being lost.                     |
>    |             |                                                          |
>    |             | More details about these issues can be found at          |
>    |             | http://bugs.digium.com/view.php?id=9313.                 |
>    +------------------------------------------------------------------------+
> 
>    +------------------------------------------------------------------------+
>    | Resolution | All users are urged to upgrade to the appropriate version |
>    |            | of their Asterisk product listed in the 'Corrected In'    |
>    |            | section below.                                            |
>    +------------------------------------------------------------------------+
> 
>    +------------------------------------------------------------------------+
>    |                           Affected Versions                            |
>    |------------------------------------------------------------------------|
>    |          Product          |   Release   |                              |
>    |                           |   Series    |                              |
>    |---------------------------+-------------+------------------------------|
>    |   Asterisk Open Source    |    1.0.x    | has not been evaluated as    |
>    |                           |             | this release series is no    |
>    |                           |             | longer maintained            |
>    |---------------------------+-------------+------------------------------|
>    |   Asterisk Open Source    |    1.2.x    | all releases prior to 1.2.18 |
>    |---------------------------+-------------+------------------------------|
>    |   Asterisk Open Source    |    1.4.x    | all releases prior to 1.4.3  |
>    |---------------------------+-------------+------------------------------|
>    | Asterisk Business Edition |    A.x.x    | all releases                 |
>    |---------------------------+-------------+------------------------------|
>    | Asterisk Business Edition |    B.x.x    | all releases prior to and    |
>    |                           |             | including B.1.3.2            |
>    |---------------------------+-------------+------------------------------|
>    |        AsteriskNOW        | pre-release | all releases prior to and    |
>    |                           |             | including Beta 5             |
>    |---------------------------+-------------+------------------------------|
>    |    Asterisk Appliance     |    0.x.x    | all releases prior to 0.4.0  |
>    |       Developer Kit       |             |                              |
>    +------------------------------------------------------------------------+
> 
>    +------------------------------------------------------------------------+
>    |                              Corrected In                              |
>    |------------------------------------------------------------------------|
>    |      Product       |                      Release                      |
>    |--------------------+---------------------------------------------------|
>    |   Asterisk Open    |         1.2.18 and 1.4.3, available from          |
>    |       Source       |    ftp://ftp.digium.com/pub/telephony/asterisk    |
>    |--------------------+---------------------------------------------------|
>    | Asterisk Business  |   B.1.3.3, available from the Asterisk Business   |
>    |      Edition       |  Edition user portal on http://www.digium.com or  |
>    |                    |           via Digium Technical Support            |
>    |--------------------+---------------------------------------------------|
>    |    AsteriskNOW     |            Beta 6, when available from            |
>    |                    | http://www.asterisknow.org, Beta 5 users can use  |
>    |                    |   use 'System Update' in the appliance control    |
>    |                    |   panel to update their version of AsteriskNOW    |
>    |--------------------+---------------------------------------------------|
>    | Asterisk Appliance |               0.4.0, available from               |
>    |   Developer Kit    |      ftp://ftp.digium.com/pub/telephony/aadk      |
>    +------------------------------------------------------------------------+
> 
>    +------------------------------------------------------------------------+
>    |       Links       | http://bugs.digium.com/view.php?id=9313            |
>    +------------------------------------------------------------------------+
> 
>    +------------------------------------------------------------------------+
>    | Asterisk Project Security Advisories are posted at                     |
>    | http://www.asterisk.org/security.                                      |
>    |                                                                        |
>    | This document may be superseded by later versions; if so, the latest   |
>    | version will be posted at                                              |
>    | http://www.asterisk.org/files/ASA-2007-011.pdf.                        |
>    +------------------------------------------------------------------------+
> 
>                Asterisk Project Security Advisory - ASA-2007-011
>               Copyright (c) 2007 Digium, Inc. All Rights Reserved.
>   Permission is hereby granted to distribute and publish this advisory in its
>                            original, unaltered form.
_______________________________________________
--Bandwidth and Colocation provided by Easynews.com --

asterisk-announce mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-announce

----- End forwarded message -----




More information about the Pkg-voip-maintainers mailing list