[SM-Grimoire-Bugs] [Bug 13899] asterisk: New release fixes four critical security vulnerabilities

bugzilla-daemon at bugs.sourcemage.org bugzilla-daemon at bugs.sourcemage.org
Wed Jul 25 19:51:29 EDT 2007


m.spitzbarth at gmx.de changed:

           What    |Removed                     |Added
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |
               Flag|integrate, to, stable,      |
                   |grimoire?                   |

------- Additional Comments From m.spitzbarth at gmx.de  2007-07-25 18:51 -------
Reopening the Bug.

While the update to version 1.4.8 does indeed fix the four security holes, there
has been a new release (1.4.9) that adds yet another security fix.

As I'm feeling lazy to type at the moment, I'm copy-pasting the email from the
astisk-announce mailing list:

---begin quote
The Asterisk development team has released Asterisk versions 1.2.23 and

These releases contain bug fixes, including one for a security vulnerability.
The vulnerability is a potential Denial of Service attack when the Asterisk
IAX2 channel driver is configured to allow unauthenticated calls.

We have released an Asterisk Security Advisory for the vulnerability.  The 
current version of the advisory can be downloaded from the ftp site.

 * Affected systems include all Asterisk installations running an affected version
that allow unauthenticated IAX2 calls.  Affected open source versions include
1.2.20 through 1.2.22, and 1.4.5 through 1.4.8.

All users that have systems that meet the criteria listed above should 
upgrade as soon as possible.
---end quote

Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

More information about the SM-Grimoire-Bugs mailing list