SourceMage Grimoire Bug List

[bugzilla-daemon AT bugs.sourcemage.org]

http://bugs.sourcemage.org/show_bug.cgi?id=14035

           Summary: asterisk: Security fixes available
           Product: Codex
           Version: stable grimoire
          Platform: Other
               URL: The function ⤽sprintf⤝ was used heavily
                    throughout the IMAP-specific voicemail code. After
                    auditing the code, two vulnerabilities were discovered,
                    both buffer overflows.
                    The following buffer overflow required write access to
                    Asterisk's configuration files in order to be exploited.
                    1) If a combination of the astspooldir (set in
                    asterisk.conf), the voicemail context, and voicemail
                    mailbox, were very long, then there was a buffer
                    overflow when playing a message or forwarding a message
                    (in the case of forwarding, the context and mailbox in
                    question are the context and mailbox that the message
                    was being forwarded to).
                    The following buffer overflow could be exploited
                    remotely.
                    http://downloads.digium.com/pub/security/AST-2007-
                    022.html
        OS/Version: other
            Status: NEW
          Severity: normal
          Priority: P2
         Component: telephony
        AssignedTo: sm-grimoire-bugs AT lists.ibiblio.org
        ReportedBy: m.spitzbarth AT gmx.de


There is a new release of asterisk that fixes two "minor" buffer overflow
scenarios mentioned in this security advisory:
http://downloads.digium.com/pub/security/AST-2007-022.html

I'm currently working at the upgrade.

-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.