| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20061206115543.9AF9DFDE1@finlandia.home.infodrom.org>
Date: Wed, 6 Dec 2006 12:55:43 +0100 (CET)
From: joey@...odrom.org (Martin Schulze)
To: debian-security-announce@...ts.debian.org (Debian Security Announcements)
Subject: [SECURITY] [DSA 1229-1] New Asterisk packages fix
arbitrary code execution
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Debian Security Advisory DSA 1229-1 security@...ian.org
http://www.debian.org/security/ Martin Schulze
December 6th, 2006 http://www.debian.org/security/faq
- --------------------------------------------------------------------------
Package : asterisk
Vulnerability : integer overflow
Problem type : remote
Debian-specific: no
CVE ID : CVE-2006-5444
CERT advisory : VU#521252
BugTraq ID : 20617
Adam Boileau discovered an integer overflow in the Skinny channel
driver in Asterisk, an Open Source Private Branch Exchange or
telephone system, as used by Cisco SCCP phones, which allows remote
attackers to execute arbitrary code.
For the stable distribution (sarge) this problem has been fixed in
version 1.0.7.dfsg.1-2sarge4.
For the unstable distribution (sid) this problem has been fixed in
version 1.2.13~dfsg-1.
We recommend that you upgrade your asterisk packages.
Upgrade Instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given at the end of this advisory:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
- --------------------------------
Source archives:
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7.dfsg.1-2sarge4.dsc
Size/MD5 checksum: 1259 2441c1ccc8467ecefc45b58711b9602f
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7.dfsg.1-2sarge4.diff.gz
Size/MD5 checksum: 70588 17c8aaae715230d9ea8d0485eb7cfe95
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7.dfsg.1.orig.tar.gz
Size/MD5 checksum: 2929488 0d0f718ccd7a06ab998c3f637df294c0
Architecture independent components:
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-config_1.0.7.dfsg.1-2sarge4_all.deb
Size/MD5 checksum: 61616 84dd16720f492033c5c034b69f033f7f
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1.0.7.dfsg.1-2sarge4_all.deb
Size/MD5 checksum: 83382 0fda6ac9d47e7d5bcd9786c7ab17ebd5
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1.0.7.dfsg.1-2sarge4_all.deb
Size/MD5 checksum: 1577766 a5ddadc5ba22723d32a74a2bc4fb9dfc
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sounds-main_1.0.7.dfsg.1-2sarge4_all.deb
Size/MD5 checksum: 1180298 bf9fae8e20a5e299d1c24e5fce59ee96
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-web-vmail_1.0.7.dfsg.1-2sarge4_all.deb
Size/MD5 checksum: 28378 eb425bfc6db224dd17346c0a03f06853
Alpha architecture:
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7.dfsg.1-2sarge4_alpha.deb
Size/MD5 checksum: 1477714 2835395f4796f717330ec4bc6decca4e
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_alpha.deb
Size/MD5 checksum: 31406 03e9021f5867a19500fadd3e27563e47
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_1.0.7.dfsg.1-2sarge4_alpha.deb
Size/MD5 checksum: 21444 06a45fc8f1407adfdcaf1453e1cd0874
AMD64 architecture:
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7.dfsg.1-2sarge4_amd64.deb
Size/MD5 checksum: 1333338 73a991fc324d71d53a375dd81b9eb8e2
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_amd64.deb
Size/MD5 checksum: 30832 21bde76d77e7948ec115c0752e025353
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_1.0.7.dfsg.1-2sarge4_amd64.deb
Size/MD5 checksum: 21444 c426ea519c9a806039aec64fc58083fc
ARM architecture:
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7.dfsg.1-2sarge4_arm.deb
Size/MD5 checksum: 1262870 4e73f23ddaadabb52c1f06b37e1c520e
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_arm.deb
Size/MD5 checksum: 29544 7d7f780f79006309910f2f6a66e06818
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_1.0.7.dfsg.1-2sarge4_arm.deb
Size/MD5 checksum: 21444 e50e31d85cc4835fc0023b02d4a19b39
HP Precision architecture:
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7.dfsg.1-2sarge4_hppa.deb
Size/MD5 checksum: 1448202 32dd05dd323f87a5e2af536e49985faa
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_hppa.deb
Size/MD5 checksum: 31476 46142d857caf78277934f9e89711b41a
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_1.0.7.dfsg.1-2sarge4_hppa.deb
Size/MD5 checksum: 21450 56f2cebadeabe4f099cf9399f55a589f
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7.dfsg.1-2sarge4_i386.deb
Size/MD5 checksum: 1171606 2810bc5ffb85764e07e7ec706dc4f928
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_i386.deb
Size/MD5 checksum: 29836 0daf81e64c836885f14b2dbf0f54343b
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_1.0.7.dfsg.1-2sarge4_i386.deb
Size/MD5 checksum: 21442 b0a56bf68687633b5965fd5bc48ada95
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7.dfsg.1-2sarge4_ia64.deb
Size/MD5 checksum: 1771294 ed00a12ab45bd6f81da7214fc4f0b99d
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_ia64.deb
Size/MD5 checksum: 32960 4f4e2c882189638bfee0f4e25868ab2b
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_1.0.7.dfsg.1-2sarge4_ia64.deb
Size/MD5 checksum: 21442 1b642cf09597da3404c55d42b6ff0ae7
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7.dfsg.1-2sarge4_m68k.deb
Size/MD5 checksum: 1184854 de5fd7c0533e64861c7446c651777fd3
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_m68k.deb
Size/MD5 checksum: 30224 0967fd0088ec26799999c267a258bb81
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_1.0.7.dfsg.1-2sarge4_m68k.deb
Size/MD5 checksum: 21462 5d19189f30b74bd2112d09a340946cf9
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7.dfsg.1-2sarge4_mips.deb
Size/MD5 checksum: 1264012 fabd550d77fe25c7e717f29bb3bf1355
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_mips.deb
Size/MD5 checksum: 29430 efd332bdb454dc03e3e2dc63bdd65ce8
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_1.0.7.dfsg.1-2sarge4_mips.deb
Size/MD5 checksum: 21448 ff71d10748a00ef5f1c3d4b8632d929f
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7.dfsg.1-2sarge4_mipsel.deb
Size/MD5 checksum: 1270346 07d3e2bc2677a460f27187264fafe80e
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_mipsel.deb
Size/MD5 checksum: 29366 49499b7916c27d1ede70eddc64505be0
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_1.0.7.dfsg.1-2sarge4_mipsel.deb
Size/MD5 checksum: 21450 530e7eb9d1a395faa2fd19dffaf2db6e
PowerPC architecture:
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7.dfsg.1-2sarge4_powerpc.deb
Size/MD5 checksum: 1425172 dae96f2c81168d452cd05b70316632db
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_powerpc.deb
Size/MD5 checksum: 31166 86982177ea3ab8dd23daa989e976c316
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_1.0.7.dfsg.1-2sarge4_powerpc.deb
Size/MD5 checksum: 21444 fafe504d906ab206c8c66c558ca866c5
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7.dfsg.1-2sarge4_s390.deb
Size/MD5 checksum: 1312516 8b8425df65ae5d632b0f8f1da6fb4c38
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_s390.deb
Size/MD5 checksum: 30846 1ab2adb0c24b96a0c8a43480cd0a5f68
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_1.0.7.dfsg.1-2sarge4_s390.deb
Size/MD5 checksum: 21442 0e283bcb7f6c4992e99ae7f823c557f3
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7.dfsg.1-2sarge4_sparc.deb
Size/MD5 checksum: 1274282 aa531e9c0c268dfabf222092b5b61e51
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_sparc.deb
Size/MD5 checksum: 29812 3a64e2bccfc0479263d2aa8d00b2cb68
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_1.0.7.dfsg.1-2sarge4_sparc.deb
Size/MD5 checksum: 21450 c9f916ccce73e0c25360affd739543e5
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iD8DBQFFdq++W5ql+IAeqTIRAoTLAKCr+6Dr+P2PbVVM2p1aKcdCUIrlagCeK+QC
/J3Yurq3X4CBeFGRSXpAeTc=
=AMcA
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists