lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 27 Aug 2013 19:26:07 -0500
From: "Asterisk Security Team" <>
Subject: AST-2013-004: Remote Crash From Late Arriving SIP

               Asterisk Project Security Advisory - AST-2013-004

          Product         Asterisk                                            
          Summary         Remote Crash From Late Arriving SIP ACK With SDP    
     Nature of Advisory   Remote Crash                                        
       Susceptibility     Remote Unauthenticated Sessions                     
          Severity        Major                                               
       Exploits Known     None                                                
        Reported On       February 11, 2013                                   
        Reported By       Colin Cuthbertson                                   
         Posted On        August 27, 2013                                     
      Last Updated On     August 27, 2013                                     
      Advisory Contact    Joshua Colp <jcolp AT digium DOT com>               
          CVE Name        Pending                                             

    Description  A remotely exploitable crash vulnerability exists in the     
                 SIP channel driver if an ACK with SDP is received after the  
                 channel has been terminated. The handling code incorrectly   
                 assumes that the channel will always be present.             

    Resolution  A check has now been added which only parses SDP and applies  
                it if an Asterisk channel is present.                         
                Note that Walter Doekes, OSSO B.V., is responsible for        
                diagnosing and providing the fix for this issue.              

                               Affected Versions
              Product             Release Series  
        Asterisk Open Source          1.8.x and above          
        Asterisk Open Source           11.x       All versions                
         Certified Asterisk           1.8.15      All versions                
         Certified Asterisk            11.2       All versions                

                                  Corrected In
                 Product                              Release                 
          Asterisk Open Source         , 11.5.1             
           Certified Asterisk                1.8.15-cert3, 11.2-cert2         

                                SVN URL                                  Revision         Asterisk  
                                                                         1.8          Asterisk  
                                                                         11 Certified 
                                                                         1.8.15   Certified 


    Asterisk Project Security Advisories are posted at                                                             
    This document may be superseded by later versions; if so, the latest      
    version will be posted at                                             and                        

                                Revision History
          Date                 Editor                  Revisions Made         
    2013-08-22         Joshua Colp              Initial revision.             

               Asterisk Project Security Advisory - AST-2013-004
              Copyright (c) 2013 Digium, Inc. All Rights Reserved.
  Permission is hereby granted to distribute and publish this advisory in its
                           original, unaltered form.

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists