Asterisk SIP Error Response Handling Bugs Let Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1017954 |
|
SecurityTracker URL: http://securitytracker.com/id/1017954
|
|
CVE Reference:
CVE-2007-2297
(Links to External Site)
|
Updated: May 12 2008
|
Original Entry Date: Apr 25 2007
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 1.4.3
|
Description:
A vulnerability was reported in Asterisk. A remote user can cause denial of service conditions.
A remote user can send specially crafted SIP response codes to cause the target service to crash. All active calls and other sessions will be lost.
The vendor was notified on March 20, 2007.
Mantis reported this vulnerability to the vendor.
Asterisk Business Edition, AsteriskNOW, and the Asterisk Appliance Developer Kit is affected.
|
Impact:
A remote user can cause the target Asterisk service to crash.
|
Solution:
The vendor has issued fixed versions (1.2.18 and 1.4.3), available at:
ftp://ftp.digium.com/pub/telephony/asterisk
The Asterisk advisory is available at:
http://www.asterisk.org/files/ASA-2007-011.pdf
|
Vendor URL: www.asterisk.org/ (Links to External Site)
|
Cause:
Exception handling error
|
Underlying OS:
Linux (Any), UNIX (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 24 Apr 2007 18:22:21 -0500
Subject: [Full-disclosure] ASA-2007-011: Multiple problems in SIP channel
|
> Asterisk Project Security Advisory - ASA-2007-011
>
> +------------------------------------------------------------------------+
> | Product | Asterisk |
> |--------------------+---------------------------------------------------|
> | Summary | Multiple problems in SIP channel parser handling |
> | | response codes |
> |--------------------+---------------------------------------------------|
> | Nature of Advisory | Denial of Service |
> |--------------------+---------------------------------------------------|
> | Susceptibility | Remote Unauthenticated Sessions |
> |--------------------+---------------------------------------------------|
> | Severity | Critical |
> |--------------------+---------------------------------------------------|
> | Exploits Known | No |
> |--------------------+---------------------------------------------------|
> | Reported On | March 20, 2007 |
> |--------------------+---------------------------------------------------|
> | Reported By | Mantis user ID 'qwerty1979' |
> |--------------------+---------------------------------------------------|
> | Posted On | April 24, 2007 |
> |--------------------+---------------------------------------------------|
> | Last Updated On | April 24, 2007 |
> |--------------------+---------------------------------------------------|
> | Advisory Contact | kpfleming@digium.com |
> +------------------------------------------------------------------------+
>
> +------------------------------------------------------------------------+
> | Description | Multiple problems have been identified in the Asterisk |
> | | SIP channel driver (chan_sip) when handling response |
> | | packets from other SIP endpoints. |
> | | |
> | | If the response packets did not contain a valid response |
> | | code in the first line of the UDP packet, the Asterisk |
> | | SIP channel driver would fail to parse the packet |
> | | properly and would cause the Asterisk process to die |
> | | with a segmentation fault. This results in all active |
> | | calls and other sessions being lost. |
> | | |
> | | More details about these issues can be found at |
> | | http://bugs.digium.com/view.php?id=9313. |
> +------------------------------------------------------------------------+
>
> +------------------------------------------------------------------------+
> | Resolution | All users are urged to upgrade to the appropriate version |
> | | of their Asterisk product listed in the 'Corrected In' |
> | | section below. |
> +------------------------------------------------------------------------+
>
> +------------------------------------------------------------------------+
> | Affected Versions |
> |------------------------------------------------------------------------|
> | Product | Release | |
> | | Series | |
> |---------------------------+-------------+------------------------------|
> | Asterisk Open Source | 1.0.x | has not been evaluated as |
> | | | this release series is no |
> | | | longer maintained |
> |---------------------------+-------------+------------------------------|
> | Asterisk Open Source | 1.2.x | all releases prior to 1.2.18 |
> |---------------------------+-------------+------------------------------|
> | Asterisk Open Source | 1.4.x | all releases prior to 1.4.3 |
> |---------------------------+-------------+------------------------------|
> | Asterisk Business Edition | A.x.x | all releases |
> |---------------------------+-------------+------------------------------|
> | Asterisk Business Edition | B.x.x | all releases prior to and |
> | | | including B.1.3.2 |
> |---------------------------+-------------+------------------------------|
> | AsteriskNOW | pre-release | all releases prior to and |
> | | | including Beta 5 |
> |---------------------------+-------------+------------------------------|
> | Asterisk Appliance | 0.x.x | all releases prior to 0.4.0 |
> | Developer Kit | | |
> +------------------------------------------------------------------------+
>
> +------------------------------------------------------------------------+
> | Corrected In |
> |------------------------------------------------------------------------|
> | Product | Release |
> |--------------------+---------------------------------------------------|
> | Asterisk Open | 1.2.18 and 1.4.3, available from |
> | Source | ftp://ftp.digium.com/pub/telephony/asterisk |
> |--------------------+---------------------------------------------------|
> | Asterisk Business | B.1.3.3, available from the Asterisk Business |
> | Edition | Edition user portal on http://www.digium.com or |
> | | via Digium Technical Support |
> |--------------------+---------------------------------------------------|
> | AsteriskNOW | Beta 6, when available from |
> | | http://www.asterisknow.org, Beta 5 users can use |
> | | use 'System Update' in the appliance control |
> | | panel to update their version of AsteriskNOW |
> |--------------------+---------------------------------------------------|
> | Asterisk Appliance | 0.4.0, available from |
> | Developer Kit | ftp://ftp.digium.com/pub/telephony/aadk |
> +------------------------------------------------------------------------+
>
> +------------------------------------------------------------------------+
> | Links | http://bugs.digium.com/view.php?id=9313 |
> +------------------------------------------------------------------------+
>
> +------------------------------------------------------------------------+
> | Asterisk Project Security Advisories are posted at |
> | http://www.asterisk.org/security. |
> | |
> | This document may be superseded by later versions; if so, the latest |
> | version will be posted at |
> | http://www.asterisk.org/files/ASA-2007-011.pdf. |
> +------------------------------------------------------------------------+
>
> Asterisk Project Security Advisory - ASA-2007-011
> Copyright (c) 2007 Digium, Inc. All Rights Reserved.
> Permission is hereby granted to distribute and publish this advisory in its
> original, unaltered form.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
|
|
