SourceMage Grimoire Bug List

[bugzilla-daemon AT bugs.sourcemage.org]

http://bugs.sourcemage.org/show_bug.cgi?id=14035


m.spitzbarth AT gmx.de changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|The function                |http://downloads.digium.com/
                   |⤽sprintf⤝ was used |pub/security/AST-2007-
                   |heavily throughout the IMAP-|022.html
                   |specific voicemail code.    |1) If a combination of the
                   |After auditing the code, two|astspooldir (set in
                   |vulnerabilities were        |asterisk.conf), the
                   |discovered                  |voicemail context, and
                   |                            |voicemail mailbox, were very
                   |                            |long
                URL|both buffer overflows.      |then there was a buffer
                   |The following buffer        |overflow when playing a
                   |overflow required write     |message or forwarding a
                   |access to Asterisk's        |message (in the case of
                   |configuration files in order|forwarding
                   |to be exploited.            |
                   |1) If a combination of the  |
                   |astspooldir (set in         |
                   |asterisk.conf), the         |
                   |voicemail context, and      |
                   |voicemail mailbox           |
                URL|were very long, then there  |the context and mailbox in
                   |was a buffer overflow when  |question are the context and
                   |playing a message or        |mailbox that the message was
                   |forwarding a message (in the|being forwarded to).
                   |case of forwarding          |The following buffer
                   |                            |overflow could be exploited
                   |                            |remotely.
                   |                            |http://downloads.digium.com/
                   |                            |pub/security/AST-2007-
                   |                            |022.html
                URL|the context and mailbox in  |
                   |question are the context and|
                   |mailbox that the message was|
                   |being forwarded to).        |
                   |The following buffer        |
                   |overflow could be exploited |
                   |remotely.                   |
                   |http://downloads.digium.com/|
                   |pub/security/AST-2007-      |
                   |022.html                    |
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED
               Flag|                            |integrate, to, stable,
                   |                            |grimoire?, integrate, to,
                   |                            |stable-rc, grimoire?, fixed,
                   |                            |in, lesser, branch+




------- Additional Comments From m.spitzbarth AT gmx.de  2007-10-11 05:43 -------
Sorry for my lack of copy'n'paste-skills at the url.

I've updated asterisk to 1.4.13 with commits
1d5930dd52849d6a3186cc16a6117f630e41e5aa and
ea8e0e6b306ffad2aa80e8b876b45597053d6642

and request integration for that into stable-rc and stable.
Feel free to deny the stable part, as it is only a minor bug (according to
digium) and stable-0.14 is hopefully released in a few days.

There will be a conflicts caused by prior bug fixes in stable and a feature
update in between.

The first cherry-pick conflicts in HISTORY, adding just a few lines at the 
top.
The second one conflicts in DETAILS. VERSION=1.4.13 and SECURITY_PATCH=7 are 
the
desired values.

-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.