AOH :: HP Unsorted S :: TB10624.HTM

SIP channel parser handling response codes



ASA-2007-011: Multiple problems in SIP channel parser handling response codes
ASA-2007-011: Multiple problems in SIP channel parser handling response codes



>                Asterisk Project Security Advisory - ASA-2007-011
> 
>    +------------------------------------------------------------------------+
>    |      Product       | Asterisk                                          |
>    |--------------------+---------------------------------------------------|
>    |      Summary       | Multiple problems in SIP channel parser handling  |
>    |                    | response codes                                    |
>    |--------------------+---------------------------------------------------|
>    | Nature of Advisory | Denial of Service                                 |
>    |--------------------+---------------------------------------------------|
>    |   Susceptibility   | Remote Unauthenticated Sessions                   |
>    |--------------------+---------------------------------------------------|
>    |      Severity      | Critical                                          |
>    |--------------------+---------------------------------------------------|
>    |   Exploits Known   | No                                                |
>    |--------------------+---------------------------------------------------|
>    |    Reported On     | March 20, 2007                                    |
>    |--------------------+---------------------------------------------------|
>    |    Reported By     | Mantis user ID 'qwerty1979'                       |
>    |--------------------+---------------------------------------------------|
>    |     Posted On      | April 24, 2007                                    |
>    |--------------------+---------------------------------------------------|
>    |  Last Updated On   | April 24, 2007                                    |
>    |--------------------+---------------------------------------------------|
> | Advisory Contact | kpfleming@digium.com | 
>    +------------------------------------------------------------------------+
> 
>    +------------------------------------------------------------------------+
>    | Description | Multiple problems have been identified in the Asterisk   |
>    |             | SIP channel driver (chan_sip) when handling response     |
>    |             | packets from other SIP endpoints.                        |
>    |             |                                                          |
>    |             | If the response packets did not contain a valid response |
>    |             | code in the first line of the UDP packet, the Asterisk   |
>    |             | SIP channel driver would fail to parse the packet        |
>    |             | properly and would cause the Asterisk process to die     |
>    |             | with a segmentation fault. This results in all active    |
>    |             | calls and other sessions being lost.                     |
>    |             |                                                          |
>    |             | More details about these issues can be found at          |
> | | http://bugs.digium.com/view.php?id=9313. | 
>    +------------------------------------------------------------------------+
> 
>    +------------------------------------------------------------------------+
>    | Resolution | All users are urged to upgrade to the appropriate version |
>    |            | of their Asterisk product listed in the 'Corrected In'    |
>    |            | section below.                                            |
>    +------------------------------------------------------------------------+
> 
>    +------------------------------------------------------------------------+
>    |                           Affected Versions                            |
>    |------------------------------------------------------------------------|
>    |          Product          |   Release   |                              |
>    |                           |   Series    |                              |
>    |---------------------------+-------------+------------------------------|
>    |   Asterisk Open Source    |    1.0.x    | has not been evaluated as    |
>    |                           |             | this release series is no    |
>    |                           |             | longer maintained            |
>    |---------------------------+-------------+------------------------------|
>    |   Asterisk Open Source    |    1.2.x    | all releases prior to 1.2.18 |
>    |---------------------------+-------------+------------------------------|
>    |   Asterisk Open Source    |    1.4.x    | all releases prior to 1.4.3  |
>    |---------------------------+-------------+------------------------------|
>    | Asterisk Business Edition |    A.x.x    | all releases                 |
>    |---------------------------+-------------+------------------------------|
>    | Asterisk Business Edition |    B.x.x    | all releases prior to and    |
>    |                           |             | including B.1.3.2            |
>    |---------------------------+-------------+------------------------------|
>    |        AsteriskNOW        | pre-release | all releases prior to and    |
>    |                           |             | including Beta 5             |
>    |---------------------------+-------------+------------------------------|
>    |    Asterisk Appliance     |    0.x.x    | all releases prior to 0.4.0  |
>    |       Developer Kit       |             |                              |
>    +------------------------------------------------------------------------+
> 
>    +------------------------------------------------------------------------+
>    |                              Corrected In                              |
>    |------------------------------------------------------------------------|
>    |      Product       |                      Release                      |
>    |--------------------+---------------------------------------------------|
>    |   Asterisk Open    |         1.2.18 and 1.4.3, available from          |
> | Source | ftp://ftp.digium.com/pub/telephony/asterisk | 
>    |--------------------+---------------------------------------------------|
>    | Asterisk Business  |   B.1.3.3, available from the Asterisk Business   |
> | Edition | Edition user portal on http://www.digium.com or | 
>    |                    |           via Digium Technical Support            |
>    |--------------------+---------------------------------------------------|
>    |    AsteriskNOW     |            Beta 6, when available from            |
> | | http://www.asterisknow.org, Beta 5 users can use | 
>    |                    |   use 'System Update' in the appliance control    |
>    |                    |   panel to update their version of AsteriskNOW    |
>    |--------------------+---------------------------------------------------|
>    | Asterisk Appliance |               0.4.0, available from               |
> | Developer Kit | ftp://ftp.digium.com/pub/telephony/aadk | 
>    +------------------------------------------------------------------------+
> 
>    +------------------------------------------------------------------------+
> | Links | http://bugs.digium.com/view.php?id=9313 | 
>    +------------------------------------------------------------------------+
> 
>    +------------------------------------------------------------------------+
>    | Asterisk Project Security Advisories are posted at                     |
> | http://www.asterisk.org/security. | 
>    |                                                                        |
>    | This document may be superseded by later versions; if so, the latest   |
>    | version will be posted at                                              |
> | http://www.asterisk.org/files/ASA-2007-011.pdf. | 
>    +------------------------------------------------------------------------+
> 
>                Asterisk Project Security Advisory - ASA-2007-011
>               Copyright (c) 2007 Digium, Inc. All Rights Reserved.
>   Permission is hereby granted to distribute and publish this advisory in its
>                            original, unaltered form.



The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.