lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 20 Oct 2014 11:41:50 -0500
From: "Asterisk Security Team" <>
Subject: [FD] AST-2014-011: Asterisk Susceptibility to POODLE Vulnerability

               Asterisk Project Security Advisory - AST-2014-011

         Product        Asterisk                                              
         Summary        Asterisk Susceptibility to POODLE Vulnerability       
    Nature of Advisory  Unauthorized Data Disclosure                          
      Susceptibility    Remote Unauthenticated Sessions                       
         Severity       Medium                                                
      Exploits Known    No                                                    
       Reported On      16 October 2014                                       
       Reported By      abelbeck                                              
        Posted On       20 October 2014                                       
     Last Updated On    October 20, 2014                                      
     Advisory Contact   Matt Jordan <mjordan AT digium DOT com>               
         CVE Name       CVE-2014-3566                                         

   Description The POODLE vulnerability - described under CVE-2014-3566 - is  
               described at                                                   
               This advisory describes the Asterisk's project susceptibility  
               to this vulnerability.                                         
               The POODLE vulnerability consists of two issues:               
               1) A vulnerability in the SSL protocol version 3.0. This       
               vulnerability has no known solution.                           
               2) The ability to force a fallback to SSLv3 when a TLS         
               connection is negotiated.                                      
               Asterisk is susceptible to both portions of the vulnerability  
               in different places.                                           
               1) The res_jabber and res_xmpp module both use SSLv3           
               exclusively, and are hence susceptible to POODLE.              
               2) The core TLS handling, used by the chan_sip channel driver, 
               Asterisk Manager Interface (AMI), and the Asterisk HTTP        
               server, defaults to allowing SSLv3/SSLv2 fallback. This allows 
               a MITM to potentially force a connection to fallback to SSLv3, 
               exposing it to the POODLE vulnerability.                       

    Resolution  Asterisk has been patched such that it no longer uses SSLv3   
                for the res_jabber/res_xmpp modules. Additionally, when the   
                encryption method is not specified, the default handling in   
                the TLS core no longer allows for a fallback to SSLv3 or      
                1) Users of Asterisk's res_jabber or res_xmpp modules should  
                upgrade to the versions of Asterisk specified in this         
                2) Users of Asterisk's chan_sip channel driver, AMI, and      
                HTTP server may set the "tlsclientmethod" or                  
                "sslclientmethod" to "tlsv1" to force TLSv1 as the only       
                allowed encryption method. Alternatively, they may also       
                upgrade to the versions of Asterisk specified in this         
                advisory. Users of Asterisk are encouraged to NOT specify     
                "sslv2" or "sslv3". Doing so will now emit a WARNING.         

                               Affected Versions       
                         Product                       Release  
                  Asterisk Open Source                  1.8.x   All versions  
                  Asterisk Open Source                  11.x    All versions  
                  Asterisk Open Source                  12.x    All versions  
                   Certified Asterisk                  1.8.28   All versions  
                   Certified Asterisk                   11.6    All versions  

                                  Corrected In
          Product                              Release                        
    Asterisk Open Source    , 11.13.1, 12.6.1               
     Certified Asterisk                1.8.28-cert2, 11.6-cert7               

                                 SVN URL                               Revision    Asterisk  
                                                                       1.8      Asterisk  
                                                                       11       Asterisk  
                                                                       12   Certified 
                                                                       1.8.28   Certified 


    Asterisk Project Security Advisories are posted at                                                             
    This document may be superseded by later versions; if so, the latest      
    version will be posted at                                             and                        

                                Revision History
       Date       Editor                     Revisions Made                   
    October 19  Matt Jordan  Initial Revision                                 

               Asterisk Project Security Advisory - AST-2014-011
              Copyright (c) 2014 Digium, Inc. All Rights Reserved.
  Permission is hereby granted to distribute and publish this advisory in its
                           original, unaltered form.

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists