Bug#411293: asterisk-chan-capi: Need a mutex for calls to capi_{cmsg, message}2str

[Moritz Muehlenhoff]

On Mon, Feb 26, 2007 at 08:38:01AM +0100, Lionel Elie Mamane wrote:
> On Sun, Feb 25, 2007 at 11:53:09PM +0000, Ben Hutchings wrote:
> > Lionel Elie Mamane <lionel at mamane.lu> wrote:
> 
> >> I'm now next to the machine and after some cable fiddling, it seems
> >> that despite the warning, basic functionality still works; it can
> >> answer to calls and make calls.
> 
> > I'm glad to hear that.  Did you apply both the isdnutils and
> > asterisk-chan-capi patches (they are both needed to close the security
> > hole)?
> 
> I tested only asterisk-chan-capi, my own recompile of your source
> package. I tested the sid version.
> 
> Time permitting, I may give the isdnutils and kernel patches a shot
> during the week, as well as the sarge version of asterisk-chan-capi.

According to the Linux ISDN maintainer CAPI messages triggering such an
overflow cannot be sent over the ISDN network due to technical limits.

I don't know asterisk-chan-capi, can CAPI messages originate otherwise?
If not, it probably doesn't need a fix for Etch.

Cheers,
        Moritz