SourceMage Grimoire Bug List

[bugzilla-daemon AT bugs.sourcemage.org]

http://bugs.sourcemage.org/show_bug.cgi?id=14604

           Summary: asterisk: Version 1.4.21.2 contains two security fixes
           Product: Codex
           Version: stable grimoire
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: P2
         Component: telephony
        AssignedTo: sm-grimoire-bugs AT lists.ibiblio.org
        ReportedBy: m.spitzbarth AT gmx.de


Asterisk version 1.4.21.2 fixes two security problems in the IAX2 channel
driver, one is a Denial of Service, the other is a traffic amplifiaction
attack.

http://downloads.digium.com/pub/security/AST-2008-010.html (CVE-2008-3263)

Description:
By flooding an Asterisk server with IAX2 'POKE' requests, an attacker may eat
up all call numbers associated with the IAX2 protocol on an Asterisk server 
and
prevent other IAX2 calls from getting through. Due to the nature of the
protocol, IAX2 POKE calls will expect an ACK packet in response to the PONG
packet sent in response to the POKE. While waiting for this ACK packet, this
dialog consumes an IAX2 call number, as the ACK packet must contain the same
call number as was allocated and sent in the PONG.

The following problem also applies to all asterisk versions prior to 1.4.21.2:
http://downloads.digium.com/pub/security/AST-2008-011.html (CVE-2008-3264)

Description:
An attacker may request an Asterisk server to send part of a firmware image.
However, as this firmware download protocol does not initiate a handshake, the
source address may be spoofed. Therefore, an IAX2 FWDOWNL request for a
firmware file may consume as little as 40 bytes, yet produces a 1040 byte
response. Coupled with multiple geographically diverse Asterisk servers, an
attacker may flood an victim site with unwanted firmware packets.


-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.