|
|
| |
| The handling of SIP dialog history was broken during the development of Asterisk 1.4. Regardless of whether recording SIP dialog history is turned on or off, the history is still recorded in memory. Furthermore, there is no upper limit on how many history items will be stored for a given SIP dialog. It is possible for an attacker to use up all of the system's memory by creating a SIP dialog that records many entires in the history and never ends. It is also worth noting for the sake of doing the math to calculate what it would take to exploit this that each SIP history entry will take up a maximum of 88 bytes. |
| |
Credit:
The information has been provided by Asterisk Security Team.
The original article can be found at: http://downloads.digium.com/pub/asa/AST-2007-020.html
|
| |
Vulnerable Systems:
* Asterisk Open Source version 1.4.10 and prior
* AsteriskNOW pre-release beta6 and prior
* Asterisk Appliance Developer Kit versions prior to 0.8.0
* s800i (Asterisk Appliance) version 1.0.2
Immune Systems:
* Asterisk Open Source version 1.4.11
* AsteriskNOW pre-release beta7
* Asterisk Appliance Developer Kit version 0.8.0
* s800i (Asterisk Appliance) version 1.0.3
Resolution:
The fix that has been added to chan_sip is to restore the functionality where SIP dialog history is not recorded in memory if it is not enabled. Furthermore, a maximum of 50 entires in the history will be stored for each dialog when recording history is turned on.
The only way to avoid this problem in affected versions of Asterisk is to disable chan_sip. If chan_sip is being used, the system must be upgraded to a version that has this issue resolved.
|
|
|
|
|
|
|
|
