bugtraq - AST-2018-007: Infinite loop when reading iostreams

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1fSVJv-0007QP-Kf@mail.digium.com>
Date: Mon, 11 Jun 2018 17:29:51 -0500
From: "Asterisk Security Team" <security@...erisk.org>
To: bugtraq@...urityfocus.com
Subject: AST-2018-007: Infinite loop when reading iostreams

               Asterisk Project Security Advisory - AST-2018-007

         Product        Asterisk                                              
         Summary        Infinite loop when reading iostreams                  
    Nature of Advisory  Denial of Service                                     
      Susceptibility    Remote Authenticated Sessions                         
         Severity       Critical                                              
      Exploits Known    No                                                    
       Reported On      April 16, 2018                                        
       Reported By      Sean Bright                                           
        Posted On       June 11, 2018                                         
     Last Updated On    June 11, 2018                                         
     Advisory Contact   Kevin Harwell <kharwell AT digium DOT com>            
         CVE Name       

    Description  When connected to Asterisk via TCP/TLS if the client         
                 abruptly disconnects, or sends a specially crafted message   
                 then Asterisk gets caught in an infinite loop while trying   
                 to read the data stream. Thus rendering the system as        
                 unusable.                                                    

    Resolution  Stricter error checking is now done when iostreams            
                encounters a problem. When an error occurs during reading it  
                is now properly handled, and continued reading is             
                appropriately stopped.                                        

                               Affected Versions       
                         Product                       Release  
                                                       Series   
                  Asterisk Open Source                  15.x    All Releases  

                                  Corrected In         
                         Product                              Release         
                  Asterisk Open Source                        15.4.1          

                                    Patches                          
                                SVN URL                              Revision 
   http://downloads.asterisk.org/pub/security/AST-2018-007-15.diff   Asterisk 
                                                                     15       

    Links  https://issues.asterisk.org/jira/browse/ASTERISK-27807             

    Asterisk Project Security Advisories are posted at                        
    http://www.asterisk.org/security                                          
                                                                              
    This document may be superseded by later versions; if so, the latest      
    version will be posted at                                                 
    http://downloads.digium.com/pub/security/AST-2018-007.pdf and             
    http://downloads.digium.com/pub/security/AST-2018-007.html                

                                Revision History
         Date          Editor                   Revisions Made                
    April 25, 2018  Kevin Harwell  Initial Revision                           

               Asterisk Project Security Advisory - AST-2018-007
              Copyright (c) 2018 Digium, Inc. All Rights Reserved.
  Permission is hereby granted to distribute and publish this advisory in its
                           original, unaltered form.