|
|
| |
| The handling of the BYE with Also transfer method was broken during the development of Asterisk 1.4. If a transfer attempt is made using this method the system will immediately crash upon handling the BYE message due to trying to copy data into a NULL pointer. It is important to note that a dialog must have already been established and up in order for this to happen. |
| |
Credit:
The information has been provided by Joshua Colp.
The original article can be found at: http://downloads.digium.com/pub/security/AST-2008-001.html
|
| |
Vulnerable Systems:
* Asterisk Open Source versions prior to 1.4.17
* Asterisk Business Edition versions prior to C.1.0-beta8
* AsteriskNOW versions prior to beta7
* Asterisk Appliance Developer Kit versions prior to Asterisk 1.4 revision 95946
* s800i (Asterisk Appliance) versions prior to 1.0.3.4
Immune Systems:
* Asterisk Open Source version 1.4.17
* Asterisk Business Edition version C.1.0
* AsteriskNOW version Beta7
* Asterisk Appliance Developer Kit version Asterisk 1.4 revision 95946
* s800i (Asterisk Appliance) version 1.0.3.4
Resolution:
A fix has been added so that the BYE with Also transfer method now properly allocates and uses the transfer data structure. It will no longer try to copy data into a NULL pointer and will operate properly.
|
|
|
