[asterisk-users] AST-2007-024 - Fallacious security advisory spread on the Internet involving buffer overflow in Zaptel's sethdlc application

[The Asterisk Development Team]

                Asterisk Project Security Advisory - AST-2007-024

    +------------------------------------------------------------------------+
    |      Product       | Zaptel                                            |
    |--------------------+---------------------------------------------------|
    |      Summary       | Potential buffer overflow from command line       |
    |                    | application "sethdlc"                             |
    |--------------------+---------------------------------------------------|
    | Nature of Advisory | Buffer overflow                                   |
    |--------------------+---------------------------------------------------|
    |   Susceptibility   | Local sessions                                    |
    |--------------------+---------------------------------------------------|
    |      Severity      | None                                              |
    |--------------------+---------------------------------------------------|
    |   Exploits Known   | None                                              |
    |--------------------+---------------------------------------------------|
    |    Reported On     | October 31, 2007                                  |
    |--------------------+---------------------------------------------------|
    |    Reported By     | Michael Bucko <michael DOT bucko AT eleytt DOT    |
    |                    | com>                                              |
    |--------------------+---------------------------------------------------|
    |     Posted On      | October 31, 2007                                  |
    |--------------------+---------------------------------------------------|
    |  Last Updated On   | November 1, 2007                                  |
    |--------------------+---------------------------------------------------|
    |  Advisory Contact  | Mark Michelson <mmichelson AT digium DOT com>     |
    |--------------------+---------------------------------------------------|
    |      CVE Name      | CVE-2007-5690                                     |
    +------------------------------------------------------------------------+

    +------------------------------------------------------------------------+
    | Description | This advisory is a response to a false security          |
    |             | vulnerability published in several places on the         |
    |             | Internet. Had Asterisk's developers been notified prior  |
    |             | to its publication, there would be no need for this.     |
    |             |                                                          |
    |             | There is a potential for a buffer overflow in the        |
    |             | sethdlc application; however, running this application   |
    |             | requires root access to the server, which means that     |
    |             | exploiting this vulnerability gains the attacker no more |
    |             | advantage than what he already has. As such, this is a   |
    |             | bug, not a security vulnerability.                       |
    +------------------------------------------------------------------------+

    +------------------------------------------------------------------------+
    | Resolution | The copy of the user-provided argument to the buffer has  |
    |            | been limited to the length of the buffer. This fix has    |
    |            | been committed to the Zaptel 1.2 and 1.4 repositories,    |
    |            | but due to the lack of severity, new releases will not be |
    |            | immediately made.                                         |
    |            |                                                           |
    |            | While we appreciate this programming error being brought  |
    |            | to our attention, we would encourage security researchers |
    |            | to contact us prior to releasing any reports of their     |
    |            | own, both so that we can fix any vulnerability found      |
    |            | prior to the release of an announcement, as well as       |
    |            | avoiding these types of mistakes (and the potential       |
    |            | embarrassment of reporting a vulnerability that wasn't)   |
    |            | in the future.                                            |
    +------------------------------------------------------------------------+

    +------------------------------------------------------------------------+
    |                           Affected Versions                            |
    |------------------------------------------------------------------------|
    |     Product     | Release Series |                                     |
    |-----------------+----------------+-------------------------------------|
    |     Zaptel      |     1.2.x      | All versions prior to 1.2.22        |
    |-----------------+----------------+-------------------------------------|
    |     Zaptel      |     1.4.x      | All versions prior to 1.4.7         |
    +------------------------------------------------------------------------+

    +------------------------------------------------------------------------+
    |                              Corrected In                              |
    |------------------------------------------------------------------------|
    |          Product           |                  Release                  |
    |----------------------------+-------------------------------------------|
    |           Zaptel           |          1.2.22, when available           |
    |----------------------------+-------------------------------------------|
    |           Zaptel           |           1.4.7, when available           |
    |----------------------------+-------------------------------------------|
    +------------------------------------------------------------------------+

    +------------------------------------------------------------------------+
    |Links |http://archives.neohapsis.com/archives/bugtraq/2007-10/0316.html |
    +------------------------------------------------------------------------+

    +------------------------------------------------------------------------+
    | Asterisk Project Security Advisories are posted at                     |
    | http://www.asterisk.org/security.                                      |
    |                                                                        |
    | This document may be superseded by later versions; if so, the latest   |
    | version will be posted at                                              |
    | http://downloads.digium.com/pub/security/AST-2007-024.pdf and          |
    | http://downloads.digium.com/pub/security/AST-2007-024.html.            |
    +------------------------------------------------------------------------+

    +------------------------------------------------------------------------+
    |                            Revision History                            |
    |------------------------------------------------------------------------|
    |    Date    |     Editor     |              Revisions Made              |
    |------------+----------------+------------------------------------------|
    | 10/31/2007 | Mark Michelson | Initial release                          |
    |------------+----------------+------------------------------------------|
    | 10/31/2007 | Mark Michelson | Changed severity, description, and       |
    |            |                | resolution                               |
    +------------------------------------------------------------------------+

                Asterisk Project Security Advisory - AST-2007-024
               Copyright (c) 2007 Digium, Inc. All Rights Reserved.
   Permission is hereby granted to distribute and publish this advisory in its
                            original, unaltered form.