Bug#433681: Fwd: [asterisk-announce] ASA-2007-017: Remote crash vulnerability in STUN implementation
Mark Purcell
msp at debian.org
Wed Jul 18 19:47:05 UTC 2007
Package: asterisk
Version: 1:1.4.0~dfsg-1
Tags: security
Severity: critical
---------- Forwarded Message ----------
Subject: [asterisk-announce] ASA-2007-017: Remote crash vulnerability in STUN implementation
Date: Tue, 17 Jul 2007
From: The Asterisk Development Team <asteriskteam at digium.com>
To: undisclosed-recipients:;
Asterisk Project Security Advisory - ASA-2007-017
+------------------------------------------------------------------------+
| Product | Asterisk |
|--------------------+---------------------------------------------------|
| Summary | Remote Crash Vulnerability in STUN implementation |
|--------------------+---------------------------------------------------|
| Nature of Advisory | Denial of Service |
|--------------------+---------------------------------------------------|
| Susceptibility | Remote Unauthenticated Sessions |
|--------------------+---------------------------------------------------|
| Severity | Critical |
|--------------------+---------------------------------------------------|
| Exploits Known | No |
|--------------------+---------------------------------------------------|
| Reported On | July 13, 2007 |
|--------------------+---------------------------------------------------|
| Reported By | Will Drewry, Google Security Team |
|--------------------+---------------------------------------------------|
| Posted On | July 17, 2007 |
|--------------------+---------------------------------------------------|
| Last Updated On | July 17, 2007 |
|--------------------+---------------------------------------------------|
| Advisory Contact | Joshua Colp <jcolp at digium.com> |
|--------------------+---------------------------------------------------|
| CVE Name | CVE-2007-3765 |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Description | The Asterisk STUN implementation in the RTP stack has a |
| | remotely exploitable crash vulnerability. A pointer may |
| | run past accessible memory if Asterisk receives a |
| | specially crafted STUN packet on an active RTP port. |
| | |
| | The code that parses the incoming STUN packets |
| | incorrectly checks that the length indicated in the STUN |
| | attribute and the size of the STUN attribute header does |
| | not exceed the available data. This will cause the data |
| | pointer to run past accessible memory and when accessed |
| | will cause a crash. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Resolution | All users that have chan_sip, chan_gtalk, chan_jingle, |
| | chan_h323, chan_mgcp, or chan_skinny enabled on an |
| | affected version should upgrade to the appropriate |
| | version listed in the correct in section of this |
| | advisory. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Affected Versions |
|------------------------------------------------------------------------|
| Product | Release | |
| | Series | |
|----------------------------------+-------------+-----------------------|
| Asterisk Open Source | 1.0.x | None affected |
|----------------------------------+-------------+-----------------------|
| Asterisk Open Source | 1.2.x | None affected |
|----------------------------------+-------------+-----------------------|
| Asterisk Open Source | 1.4.x | All versions prior to |
| | | 1.4.8 |
|----------------------------------+-------------+-----------------------|
| Asterisk Business Edition | A.x.x | None affected |
|----------------------------------+-------------+-----------------------|
| Asterisk Business Edition | B.x.x | None affected |
|----------------------------------+-------------+-----------------------|
| AsteriskNOW | pre-release | All versions prior to |
| | | beta7 |
|----------------------------------+-------------+-----------------------|
| Asterisk Appliance Developer Kit | 0.x.x | All versions prior to |
| | | 0.5.0 |
|----------------------------------+-------------+-----------------------|
| s800i (Asterisk Appliance) | 1.0.x | All versions prior to |
| | | 1.0.2 |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Corrected In |
|------------------------------------------------------------------------|
| Product | Release |
|-----------------+------------------------------------------------------|
| Asterisk Open | 1.4.8 available from |
| Source | ftp://ftp.digium.com/pub/telephony/asterisk |
|-----------------+------------------------------------------------------|
| AsteriskNOW | Beta7, available from http://www.asterisknow.org/. |
| | Beta5 and Beta6 users can update using the system |
| | update feature in the appliance control panel. |
|-----------------+------------------------------------------------------|
| Asterisk | 0.5.0, available from |
| Appliance | ftp://ftp.digium.com/pub/telephony/aadk/ |
| Developer Kit | |
|-----------------+------------------------------------------------------|
| s800i (Asterisk | 1.0.2 |
| Appliance) | |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Links | |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Asterisk Project Security Advisories are posted at |
| http://www.asterisk.org/security. |
| |
| This document may be superseded by later versions; if so, the latest |
| version will be posted at |
| http://ftp.digium.com/pub/asa/ASA-2007-017.pdf. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Revision History |
|------------------------------------------------------------------------|
| Date | Editor | Revisions Made |
|--------------------+-----------------------+---------------------------|
| July 17, 2006 | jcolp at digium.com | Initial Release |
+------------------------------------------------------------------------+
Asterisk Project Security Advisory - ASA-2007-017
Copyright (c) 2007 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.
_______________________________________________
--Bandwidth and Colocation Provided by http://www.api-digital.com--
asterisk-announce mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-announce
-------------------------------------------------------
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part.
Url : http://lists.alioth.debian.org/pipermail/pkg-voip-maintainers/attachments/20070718/39c1ac92/attachment-0001.pgp
More information about the Pkg-voip-maintainers
mailing list