FreshPorts - VuXML

Asterisk project reports:

Stack Buffer Overflow in HTTP Manager

Remote Crash Vulnerability in Milliwatt Application

gt 1.4.* lt 1.4.44

gt 1.6.* lt 1.6.2.23

gt 1.8.* lt 1.8.10.1

gt 10.* lt 10.2.1

The Asterisk Development Team reports:

It is possible for a user of the Asterisk Manager Interface to bypass a security check and execute shell commands when they should not have that ability. Sending the "Async" header with the "Application" header during an Originate action, allows authenticated manager users to execute shell commands. Only users with the "system" privilege should be able to do this.

On systems that have the Asterisk Manager Interface, Skinny, SIP over TCP, or the built in HTTP server enabled, it is possible for an attacker to open as many connections to asterisk as he wishes. This will cause Asterisk to run out of available file descriptors and stop processing any new calls. Additionally, disk space can be exhausted as Asterisk logs failures to open new file descriptors.

gt 1.4.* lt 1.4.40.1

gt 1.6.* lt 1.6.2.17.3

gt 1.8.* lt 1.8.3.3

The Asterisk Development Team reports:

AST-2011-008: If a remote user sends a SIP packet containing a NULL, Asterisk assumes available data extends past the null to the end of the packet when the buffer is actually truncated when copied. This causes SIP header parsing to modify data past the end of the buffer altering unrelated memory structures. This vulnerability does not affect TCP/TLS connections.

AST-2011-009: A remote user sending a SIP packet containing a Contact header with a missing left angle bracket causes Asterisk to access a null pointer.

AST-2011-010: A memory address was inadvertently transmitted over the network via IAX2 via an option control frame and the remote party would try to access it.

Possible enumeration of SIP users due to differing authentication responses.

gt 1.4.* lt 1.4.41.2

gt 1.6.* lt 1.6.2.18.2

gt 1.8.* lt 1.8.4.4

The Asterisk Development Team reports:

The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.2, 1.8.1.2, and 1.8.2.1 resolve an issue when forming an outgoing SIP request while in pedantic mode, which can cause a stack buffer to be made to overflow if supplied with carefully crafted caller ID information. The issue and resolution are described in the AST-2011-001 security advisory.

gt 1.4.* lt 1.4.39.1

gt 1.6.* lt 1.6.2.16.1

gt 1.8.* lt 1.8.2.2

The Asterisk Development Team reports:

The releases of Asterisk 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and 1.8.2.4 resolve an issue that when decoding UDPTL packets, multiple heap based arrays can be made to overflow by specially crafted packets. Systems configured for T.38 pass through or termination are vulnerable. The issue and resolution are described in the AST-2011-002 security advisory.

gt 1.4.* lt 1.4.39.2

gt 1.6.* lt 1.6.2.16.2

gt 1.8.* lt 1.8.2.4