SourceMage Grimoire Bug List

[bugzilla-daemon AT bugs.sourcemage.org]

http://bugs.sourcemage.org/show_bug.cgi?id=13899


m.spitzbarth AT gmx.de changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |
               Flag|integrate, to, stable,      |
                   |grimoire?                   |




------- Additional Comments From m.spitzbarth AT gmx.de  2007-07-25 18:51 -------
Reopening the Bug.

While the update to version 1.4.8 does indeed fix the four security holes, 
there
has been a new release (1.4.9) that adds yet another security fix.

As I'm feeling lazy to type at the moment, I'm copy-pasting the email from the
astisk-announce mailing list:

---begin quote
The Asterisk development team has released Asterisk versions 1.2.23 and
1.4.9.

These releases contain bug fixes, including one for a security vulnerability.
The vulnerability is a potential Denial of Service attack when the Asterisk
IAX2 channel driver is configured to allow unauthenticated calls.

We have released an Asterisk Security Advisory for the vulnerability.  The 
current version of the advisory can be downloaded from the ftp site.

http://ftp.digium.com/pub/asa/ASA-2007-018.pdf
 * Affected systems include all Asterisk installations running an affected 
version
that allow unauthenticated IAX2 calls.  Affected open source versions include
1.2.20 through 1.2.22, and 1.4.5 through 1.4.8.

All users that have systems that meet the criteria listed above should 
upgrade as soon as possible.
---end quote

-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.