Skip to Content.
Sympa Menu

sm-grimoire-bugs - [SM-Grimoire-Bugs] [Bug 14604] New: asterisk: Version 1.4.21.2 contains two security fixes

sm-grimoire-bugs AT lists.ibiblio.org

Subject: SourceMage Grimoire Bug List

List archive

Chronological Thread  
  • From: bugzilla-daemon AT bugs.sourcemage.org
  • To: sm-grimoire-bugs AT lists.ibiblio.org
  • Subject: [SM-Grimoire-Bugs] [Bug 14604] New: asterisk: Version 1.4.21.2 contains two security fixes
  • Date: 25 Jul 2008 18:24:21 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=14604

Summary: asterisk: Version 1.4.21.2 contains two security fixes
Product: Codex
Version: stable grimoire
Platform: All
OS/Version: All
Status: NEW
Severity: normal
Priority: P2
Component: telephony
AssignedTo: sm-grimoire-bugs AT lists.ibiblio.org
ReportedBy: m.spitzbarth AT gmx.de


Asterisk version 1.4.21.2 fixes two security problems in the IAX2 channel
driver, one is a Denial of Service, the other is a traffic amplifiaction
attack.

http://downloads.digium.com/pub/security/AST-2008-010.html (CVE-2008-3263)

Description:
By flooding an Asterisk server with IAX2 'POKE' requests, an attacker may eat
up all call numbers associated with the IAX2 protocol on an Asterisk server
and
prevent other IAX2 calls from getting through. Due to the nature of the
protocol, IAX2 POKE calls will expect an ACK packet in response to the PONG
packet sent in response to the POKE. While waiting for this ACK packet, this
dialog consumes an IAX2 call number, as the ACK packet must contain the same
call number as was allocated and sent in the PONG.

The following problem also applies to all asterisk versions prior to 1.4.21.2:
http://downloads.digium.com/pub/security/AST-2008-011.html (CVE-2008-3264)

Description:
An attacker may request an Asterisk server to send part of a firmware image.
However, as this firmware download protocol does not initiate a handshake, the
source address may be spoofed. Therefore, an IAX2 FWDOWNL request for a
firmware file may consume as little as 40 bytes, yet produces a 1040 byte
response. Coupled with multiple geographically diverse Asterisk servers, an
attacker may flood an victim site with unwanted firmware packets.


--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.




Archive powered by MHonArc 2.6.24.

Top of Page