Asterisk Project Security Advisory - AST-2008-009
±-----------------------------------------------------------------------+
| Product | Asterisk-Addons |
|--------------------±--------------------------------------------------|
| Summary | Remote crash vulnerability in ooh323 channel |
| | driver |
|--------------------±--------------------------------------------------|
| Nature of Advisory | Remote crash |
|--------------------±--------------------------------------------------|
| Susceptibility | Remote unauthenticated sessions |
|--------------------±--------------------------------------------------|
| Severity | Major |
|--------------------±--------------------------------------------------|
| Exploits Known | No |
|--------------------±--------------------------------------------------|
| Reported On | May 29, 2008 |
|--------------------±--------------------------------------------------|
| Reported By | Tzafrir Cohen <tzafrir DOT cohen AT xorcom DOT |
| | com> |
|--------------------±--------------------------------------------------|
| Posted On | June 4, 2008 |
|--------------------±--------------------------------------------------|
| Last Updated On | June 4, 2008 |
|--------------------±--------------------------------------------------|
| Advisory Contact | Mark Michelson <mmichelson AT digium DOT com> |
|--------------------±--------------------------------------------------|
| CVE Name | CVE-2008-2543 |
±-----------------------------------------------------------------------+
±-----------------------------------------------------------------------+
| Description | The ooh323 channel driver provided in Asterisk Addons |
| | used a TCP connection to pass commands internally. The |
| | payload of these packets included addresses of memory |
| | which were to be freed after the command was processed. |
| | By sending arbitrary data to the listening TCP socket, |
| | one could cause an almost certain crash since the |
| | command handler would attempt to free invalid memory. |
| | This problem was made worse by the fact that the |
| | listening TCP socket was bound to whatever IP address |
| | was specified by the "bindaddr" option in ooh323.conf |
±-----------------------------------------------------------------------+
±-----------------------------------------------------------------------+
| Resolution | The TCP connection used by ooh323 has been replaced with |
| | a pipe. The effect of this change is that data from |
| | outside the ooh323 process may not be injected. |
±-----------------------------------------------------------------------+
±-----------------------------------------------------------------------+
Affected Versions |
---|
Product |
----------------------------------±------------±---------------------- |
Asterisk Open Source |
----------------------------------±------------±---------------------- |
Asterisk Open Source |
----------------------------------±------------±---------------------- |
Asterisk Open Source |
----------------------------------±------------±---------------------- |
Asterisk Addons |
----------------------------------±------------±---------------------- |
Asterisk Addons |
----------------------------------±------------±---------------------- |
Asterisk Business Edition |
----------------------------------±------------±---------------------- |
Asterisk Business Edition |
----------------------------------±------------±---------------------- |
Asterisk Business Edition |
----------------------------------±------------±---------------------- |
AsteriskNOW |
----------------------------------±------------±---------------------- |
Asterisk Appliance Developer Kit |
----------------------------------±------------±---------------------- |
s800i (Asterisk Appliance) |
±-----------------------------------------------------------------------+ |
±-----------------------------------------------------------------------+
Corrected In |
---|
Product |
------------------------------------------±---------------------------- |
Asterisk Addons 1.2 |
------------------------------------------±---------------------------- |
Asterisk-Addons 1.4 |
------------------------------------------±---------------------------- |
±-----------------------------------------------------------------------+ |
±-----------------------------------------------------------------------+
| Links | |
±-----------------------------------------------------------------------+
±-----------------------------------------------------------------------+
| Asterisk Project Security Advisories are posted at |
| http://www.asterisk.org/security |
| |
| This document may be superseded by later versions; if so, the latest |
| version will be posted at |
| http://downloads.digium.com/pub/security/AST-2008-009.pdf and |
| http://downloads.digium.com/pub/security/AST-2008-009.html |
±-----------------------------------------------------------------------+
±-----------------------------------------------------------------------+
Revision History |
---|
Date |
-------------------±---------------------±---------------------------- |
Jun 3, 2008 |
±-----------------------------------------------------------------------+ |
Asterisk Project Security Advisory - AST-2008-009
Copyright (c) 2008 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.