|
Brought to you by:
Suppliers of:
|
|
|
| |
| A security vulnerability in Asterisk's Skinny protocol allows remote attackers to cause the Asterisk server to crash by sending it a malformed Skinny packet. |
| |
Credit:
The information has been provided by Jason Parker.
The original article can be found at: http://ftp.digium.com/pub/asa/ASA-2007-016.pdf
|
| |
Vulnerable Systems:
* Asterisk Open Source versions prior to 1.4.8
* AsteriskNOW prerelease versions prior to beta7
* Asterisk Appliance Developer Kit versions prior to 0.5.0
* s800i (Asterisk Appliance) versions prior to 1.0.2
Immune Systems:
* Asterisk Open Source version 1.4.8
* AsteriskNOW Beta7
* Asterisk Appliance Developer Kit version 0.5.0
* s800i (Asterisk Appliance) version 1.0.2
The Asterisk Skinny channel driver, chan_skinny, has a remotely exploitable crash vulnerability. A segfault can occur when Asterisk receives a packet where the claimed length of the data is between 0 and 3, followed by length + 4 or more bytes, due to an overly large memcpy. The side effects of this extremely large memcpy have not been investigated.
Resolution:
All users that have chan_skinny enabled should upgrade to the appropriate version listed in the corrected in section of this advisory. As a workaround, users who do not require chan_skinny may add the line "noload => chan_skinny.so" (without quotes) to /etc/asterisk/modules.conf, and restart Asterisk.
|
|
|
|
|
