Skip to Content.
Sympa Menu

sm-grimoire-bugs - [SM-Grimoire-Bugs] [Bug 13959] New: asterisk: monthly security update to 1.4.11

sm-grimoire-bugs AT lists.ibiblio.org

Subject: SourceMage Grimoire Bug List

List archive

Chronological Thread  
  • From: bugzilla-daemon AT bugs.sourcemage.org
  • To: sm-grimoire-bugs AT lists.ibiblio.org
  • Subject: [SM-Grimoire-Bugs] [Bug 13959] New: asterisk: monthly security update to 1.4.11
  • Date: 25 Aug 2007 16:04:38 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=13959

Summary: asterisk: monthly security update to 1.4.11
Product: Codex
Version: stable grimoire
Platform: Other
URL: http://www.asterisk.org/security
OS/Version: other
Status: NEW
Severity: normal
Priority: P2
Component: telephony
AssignedTo: sm-grimoire-bugs AT lists.ibiblio.org
ReportedBy: m.spitzbarth AT gmx.de


There are three issues with the asterisk spell that is in the stable-13
grimoire:

1) The asterisk team seems to have a new developer that signs the tarballs,
making it a total of five people who sign the spell. Sorcery successfully
checks four signatures and fails to verify the fifth because of a missing
key.
The same problem occurs with zaptel, so I'll add two keys to asterisk.gpg.

2) http://downloads.digium.com/pub/asa/AST-2007-020.html
Version 1.4.11 fixes a possibility for a Denial of Service attack in the
SIP
channel driver. An attacker can make asterisk use up the whole available
system ram.

3) http://downloads.digium.com/pub/asa/AST-2007-021.html
When asterisk uses IMAP to store voicemail and the user listens to it via
his phone, and there is a email message with an invaild/corrupted/prepared
MIME body in the users mailbox, then asterisk will crash.
As this is a minor problem, there has been no new release for the bugfix,
but I'll include the patch for it anyways.
The patch is available at
http://lists.digium.com/pipermail/asterisk-commits/2007-August/015743.html

--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.



  • [SM-Grimoire-Bugs] [Bug 13959] New: asterisk: monthly security update to 1.4.11, bugzilla-daemon, 08/25/2007

Archive powered by MHonArc 2.6.24.

Top of Page