=====================================================================
                                    CERT-Renater

                         Note d'Information No. 2008/VULN211
_____________________________________________________________________

DATE                      : 06/06/2008

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running Asterisk-Addons.

======================================================================
http://downloads.digium.com/pub/security/AST-2008-009.html
______________________________________________________________________

                Asterisk Project Security Advisory - AST-2008-009

 
+------------------------------------------------------------------------+
|      Product       | Asterisk-Addons                                   |
 
|--------------------+---------------------------------------------------|
|      Summary       | Remote crash vulnerability in ooh323 channel      |
|                    | driver                                            |
 
|--------------------+---------------------------------------------------|
| Nature of Advisory | Remote crash                                      |
 
|--------------------+---------------------------------------------------|
|   Susceptibility   | Remote unauthenticated sessions                   |
 
|--------------------+---------------------------------------------------|
|      Severity      | Major                                             |
 
|--------------------+---------------------------------------------------|
|   Exploits Known   | No                                                |
 
|--------------------+---------------------------------------------------|
|    Reported On     | May 29, 2008                                      |
 
|--------------------+---------------------------------------------------|
|    Reported By     | Tzafrir Cohen <tzafrir DOT cohen AT xorcom DOT    |
|                    | com>                                              |
 
|--------------------+---------------------------------------------------|
|     Posted On      | June 4, 2008                                      |
 
|--------------------+---------------------------------------------------|
|  Last Updated On   | June 4, 2008                                      |
 
|--------------------+---------------------------------------------------|
|  Advisory Contact  | Mark Michelson <mmichelson AT digium DOT com>     |
 
|--------------------+---------------------------------------------------|
|      CVE Name      | CVE-2008-2543                                     |
 
+------------------------------------------------------------------------+

 
+------------------------------------------------------------------------+
| Description | The ooh323 channel driver provided in Asterisk Addons    |
|             | used a TCP connection to pass commands internally. The   |
|             | payload of these packets included addresses of memory    |
|             | which were to be freed after the command was processed.  |
|             | By sending arbitrary data to the listening TCP socket,   |
|             | one could cause an almost certain crash since the        |
|             | command handler would attempt to free invalid memory.    |
|             | This problem was made worse by the fact that the         |
|             | listening TCP socket was bound to whatever IP address    |
|             | was specified by the "bindaddr" option in ooh323.conf    |
 
+------------------------------------------------------------------------+

 
+------------------------------------------------------------------------+
| Resolution | The TCP connection used by ooh323 has been replaced with  |
|            | a pipe. The effect of this change is that data from       |
|            | outside the ooh323 process may not be injected.           |
 
+------------------------------------------------------------------------+

 
+------------------------------------------------------------------------+
|                           Affected Versions                            |
 
|------------------------------------------------------------------------|
|             Product              |   Release   |                       |
|                                  |   Series    |                       |
 
|----------------------------------+-------------+-----------------------|
|       Asterisk Open Source       |    1.0.x    | N/A                   |
 
|----------------------------------+-------------+-----------------------|
|       Asterisk Open Source       |    1.2.x    | N/A                   |
 
|----------------------------------+-------------+-----------------------|
|       Asterisk Open Source       |    1.4.x    | N/A                   |
 
|----------------------------------+-------------+-----------------------|
|         Asterisk Addons          |    1.2.x    | All versions prior to |
|                                  |             | 1.2.9                 |
 
|----------------------------------+-------------+-----------------------|
|         Asterisk Addons          |    1.4.x    | All versions prior to |
|                                  |             | 1.4.7                 |
 
|----------------------------------+-------------+-----------------------|
|    Asterisk Business Edition     |    A.x.x    | N/A                   |
 
|----------------------------------+-------------+-----------------------|
|    Asterisk Business Edition     |    B.x.x    | N/A                   |
 
|----------------------------------+-------------+-----------------------|
|    Asterisk Business Edition     |    C.x.x    | N/A                   |
 
|----------------------------------+-------------+-----------------------|
|           AsteriskNOW            | pre-release | N/A                   |
 
|----------------------------------+-------------+-----------------------|
| Asterisk Appliance Developer Kit |    0.x.x    | N/A                   |
 
|----------------------------------+-------------+-----------------------|
|    s800i (Asterisk Appliance)    |    1.0.x    | N/A                   |
 
+------------------------------------------------------------------------+

 
+------------------------------------------------------------------------+
|                              Corrected In                              |
 
|------------------------------------------------------------------------|
|                 Product                  |           Release           |
 
|------------------------------------------+-----------------------------|
|           Asterisk Addons 1.2            |            1.2.9            |
 
|------------------------------------------+-----------------------------|
|           Asterisk-Addons 1.4            |            1.4.7            |
 
|------------------------------------------+-----------------------------|
 
+------------------------------------------------------------------------+

 
+------------------------------------------------------------------------+
    |        Links        | 
      |
 
+------------------------------------------------------------------------+

 
+------------------------------------------------------------------------+
| Asterisk Project Security Advisories are posted at                     |
| http://www.asterisk.org/security                                       |
|                                                                        |
| This document may be superseded by later versions; if so, the latest   |
| version will be posted at                                              |
| http://downloads.digium.com/pub/security/AST-2008-009.pdf and          |
| http://downloads.digium.com/pub/security/AST-2008-009.html             |
 
+------------------------------------------------------------------------+

 
+------------------------------------------------------------------------+
|                            Revision History                            |
 
|------------------------------------------------------------------------|
|       Date        |        Editor        |       Revisions Made        |
 
|-------------------+----------------------+-----------------------------|
    | Jun 3, 2008       | Mark Michelson       | Initial draft 
      |
 
+------------------------------------------------------------------------+

                Asterisk Project Security Advisory - AST-2008-009
               Copyright (c) 2008 Digium, Inc. All Rights Reserved.
   Permission is hereby granted to distribute and publish this advisory 
in its
                            original, unaltered form.

======================================================================

           =========================================================
           Les serveurs de référence du CERT-Renater
           http://www.urec.fr/securite
           http://www.cru.fr/securite
           http://www.renater.fr
           =========================================================
           + CERT-RENATER          | tel : 01-53-94-20-44          +
           + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
           + 75013 Paris           | email: certsvp@renater.fr     +
           =========================================================