[asterisk-security] AST-2009-005: Remote Crash Vulnerability in SIP channel driver
Asterisk Security Team
security at asterisk.org
Tue Aug 11 09:00:14 CDT 2009
Asterisk Project Security Advisory - AST-2009-005
+------------------------------------------------------------------------+
| Product | Asterisk |
|---------------------+--------------------------------------------------|
| Summary | Remote Crash Vulnerability in SIP channel driver |
|---------------------+--------------------------------------------------|
| Nature of Advisory | Denial of Service |
|---------------------+--------------------------------------------------|
| Susceptibility | Remote Unauthenticated Sessions |
|---------------------+--------------------------------------------------|
| Severity | Critical in 1.6.1; minor in lesser versions |
|---------------------+--------------------------------------------------|
| Exploits Known | No |
|---------------------+--------------------------------------------------|
| Reported On | July 28, 2009 |
|---------------------+--------------------------------------------------|
| Reported By | Nick Baggott < nbaggott AT mudynamics DOT com > |
|---------------------+--------------------------------------------------|
| Posted On | August 10, 2009 |
|---------------------+--------------------------------------------------|
| Last Updated On | August 10, 2009 |
|---------------------+--------------------------------------------------|
| Advisory Contact | Tilghman Lesher < tlesher AT digium DOT com > |
|---------------------+--------------------------------------------------|
| CVE Name | CVE-2009-2726 |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Description | On certain implementations of libc, the scanf family of |
| | functions uses an unbounded amount of stack memory to |
| | repeatedly allocate string buffers prior to conversion |
| | to the target type. Coupled with Asterisk's allocation |
| | of thread stack sizes that are smaller than the default, |
| | an attacker may exhaust stack memory in the SIP stack |
| | network thread by presenting excessively long numeric |
| | strings in various fields. |
| | |
| | Note that while this potential vulnerability has existed |
| | in Asterisk for a very long time, it is only potentially |
| | exploitable in 1.6.1 and above, since those versions are |
| | the first that have allowed SIP packets to exceed 1500 |
| | bytes total, which does not permit strings that are |
| | large enough to crash Asterisk. (The number strings |
| | presented to us by the security researcher were |
| | approximately 32,000 bytes long.) |
| | |
| | Additionally note that while this can crash Asterisk, |
| | execution of arbitrary code is not possible with this |
| | vector. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Resolution | Upgrade Asterisk to one of the releases listed below. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Affected Versions |
|------------------------------------------------------------------------|
| Product | Release | |
| | Series | |
|----------------------------+------------+------------------------------|
| Asterisk Open Source | 1.2.x | All versions prior to 1.2.34 |
|----------------------------+------------+------------------------------|
| Asterisk Open Source | 1.4.x | All versions prior to |
| | | 1.4.26.1 |
|----------------------------+------------+------------------------------|
| Asterisk Open Source | 1.6.0.x | All versions prior to |
| | | 1.6.0.12 |
|----------------------------+------------+------------------------------|
| Asterisk Open Source | 1.6.1.x | All versions prior to |
| | | 1.6.1.4 |
|----------------------------+------------+------------------------------|
| Asterisk Addons | 1.2.x | Not affected |
|----------------------------+------------+------------------------------|
| Asterisk Addons | 1.4.x | Not affected |
|----------------------------+------------+------------------------------|
| Asterisk Addons | 1.6.0.x | Not affected |
|----------------------------+------------+------------------------------|
| Asterisk Addons | 1.6.1.x | Not affected |
|----------------------------+------------+------------------------------|
| Asterisk Business Edition | A.x.x | All versions |
|----------------------------+------------+------------------------------|
| Asterisk Business Edition | B.x.x | All versions prior to |
| | | B.2.5.9 |
|----------------------------+------------+------------------------------|
| Asterisk Business Edition | C.2.x | All versions prior to |
| | | C.2.4.1 |
|----------------------------+------------+------------------------------|
| Asterisk Business Edition | C.3.x | All versions prior to C.3.1 |
|----------------------------+------------+------------------------------|
| AsteriskNOW | 1.5 | Not affected |
|----------------------------+------------+------------------------------|
| s800i (Asterisk Appliance) | 1.2.x | All versions prior to |
| | | 1.3.0.3 |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Corrected In |
|------------------------------------------------------------------------|
| Product | Release |
|---------------------------------------------+--------------------------|
| Asterisk Open Source | 1.2.34 |
|---------------------------------------------+--------------------------|
| Asterisk Open Source | 1.4.26.1 |
|---------------------------------------------+--------------------------|
| Asterisk Open Source | 1.6.0.12 |
|---------------------------------------------+--------------------------|
| Asterisk Open Source | 1.6.1.4 |
|---------------------------------------------+--------------------------|
| Asterisk Business Edition | B.2.5.9 |
|---------------------------------------------+--------------------------|
| Asterisk Business Edition | C.2.4.1 |
|---------------------------------------------+--------------------------|
| Asterisk Business Edition | C.3.1 |
|---------------------------------------------+--------------------------|
| s800i (Asterisk Appliance) | 1.3.0.3 |
+------------------------------------------------------------------------+
+---------------------------------------------------------------------------+
| Patches |
|---------------------------------------------------------------------------|
| Link |Branch|
|--------------------------------------------------------------------+------|
|http://downloads.digium.com/pub/security/AST-2009-005-1.2.diff.txt |1.2 |
|--------------------------------------------------------------------+------|
|http://downloads.digium.com/pub/security/AST-2009-005-1.4.diff.txt |1.4 |
|--------------------------------------------------------------------+------|
|http://downloads.digium.com/pub/security/AST-2009-005-trunk.diff.txt|trunk |
|--------------------------------------------------------------------+------|
|http://downloads.digium.com/pub/security/AST-2009-005-1.6.0.diff.txt|1.6.0 |
|--------------------------------------------------------------------+------|
|http://downloads.digium.com/pub/security/AST-2009-005-1.6.1.diff.txt|1.6.1 |
|--------------------------------------------------------------------+------|
|http://downloads.digium.com/pub/security/AST-2009-005-1.6.2.diff.txt|1.6.2 |
+---------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Links | http://labs.mudynamics.com/advisories/MU-200908-01.txt |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Asterisk Project Security Advisories are posted at |
| http://www.asterisk.org/security |
| |
| This document may be superseded by later versions; if so, the latest |
| version will be posted at |
| http://downloads.digium.com/pub/security/AST-2009-005.pdf and |
| http://downloads.digium.com/pub/security/AST-2009-005.html |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Revision History |
|------------------------------------------------------------------------|
| Date | Editor | Revisions Made |
|---------------------+----------------------+---------------------------|
| August 10, 2009 | Tilghman Lesher | Initial release |
+------------------------------------------------------------------------+
Asterisk Project Security Advisory - AST-2009-005
Copyright (c) 2009 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.
More information about the asterisk-security
mailing list