==================================================================== CERT-Renater Note d'Information No. 2012/VULN197 ____________________________________________________________________ DATE : 24/04/2012 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S) : Systems running Asterisk Open Source versions prior to 1.6.2.24, 1.8.11.1, 10.3.1, Asterisk Business Edition versions prior to C.3.7.4. ====================================================================== http://downloads.asterisk.org/pub/security/AST-2012-004.html http://downloads.asterisk.org/pub/security/AST-2012-005.html http://downloads.asterisk.org/pub/security/AST-2012-006.html ______________________________________________________________________ Asterisk Open Source 1.6.2.24, 1.8.11.1, 10.3.1 Asterisk Business Edition C.3.7.4 Asterisk Project Security Advisory - AST-2012-004 Product Asterisk Summary Asterisk Manager User Unauthorized Shell Access Nature of Advisory Permission Escalation Susceptibility Remote Authenticated Sessions Severity Minor Exploits Known No Reported On February 23, 2011 Reported By David Woolley Posted On April 23, 2012 Last Updated On April 23, 2012 Advisory Contact Jonathan Rose < jrose AT digium DOT com > CVE Name Description A user of the Asterisk Manager Interface can bypass a security check and execute shell commands when they lack permission to do so. Under normal conditions, a user should only be able to run shell commands if that user has System class authorization. Users could bypass this restriction by using the MixMonitor application with the originate action or by using either the GetVar or Status manager actions in combination with the SHELL and EVAL functions. The patch adds checks in each affected action to verify if a user has System class authorization. If the user does not have those authorizations, Asterisk rejects the action if it detects the use of any functions or applications that run system commands. Resolution Asterisk now performs checks against manager commands that cause these behaviors for each of the affected actions. Affected Versions Product Release Series Asterisk Open Source 1.6.2.x All versions Asterisk Open Source 1.8.x All versions Asterisk Open Source 10.x All versions Asterisk Business Edition C.3.x All versions Corrected In Product Release Asterisk Open Source 1.6.2.24, 1.8.11.1, 10.3.1 Asterisk Business Edition C.3.7.4 Patches SVN URL Revision http://downloads.asterisk.org/pub/security/AST-2012-004-1.6.2.diff v1.6.2 http://downloads.asterisk.org/pub/security/AST-2012-004-1.8.diff v1.8 http://downloads.asterisk.org/pub/security/AST-2012-004-10.diff v10 Links https://issues.asterisk.org/jira/browse/ASTERISK-17465 Asterisk Project Security Advisories are posted at http://www.asterisk.org/security This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2012-004.pdf and http://downloads.digium.com/pub/security/AST-2012-004.html Revision History Date Editor Revisions Made 04/23/2012 Jonathan Rose Initial Release Asterisk Project Security Advisory - AST-2012-004 Copyright (c) 2012 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form. - ------------------------------------------------------------------------------ Asterisk Project Security Advisory - AST-2012-005 Product Asterisk Summary Heap Buffer Overflow in Skinny Channel Driver Nature of Advisory Exploitable Heap Buffer Overflow Susceptibility Remote Authenticated Sessions Severity Minor Exploits Known No Reported On March 26, 2012 Reported By Russell Bryant Posted On April 23, 2012 Last Updated On April 23, 2012 Advisory Contact Matt Jordan < mjordan AT digium DOT com > CVE Name Description In the Skinny channel driver, KEYPAD_BUTTON_MESSAGE events are queued for processing in a buffer allocated on the heap, where each DTMF value that is received is placed on the end of the buffer. Since the length of the buffer is never checked, an attacker could send sufficient KEYPAD_BUTTON_MESSAGE events such that the buffer is overrun. Resolution The length of the buffer is now checked before appending a value to the end of the buffer. Affected Versions Product Release Series Asterisk Open Source 1.6.2.x All Versions Asterisk Open Source 1.8.x All Versions Asterisk Open Source 10.x All Versions Corrected In Product Release Asterisk Open Source 1.6.2.24, 1.8.11.1, 10.3.1 Patches SVN URL Revision http://downloads.asterisk.org/pub/security/AST-2012-005-1.6.2.diff v1.6.2 http://downloads.asterisk.org/pub/security/AST-2012-005-1.8.diff v1.8 http://downloads.asterisk.org/pub/security/AST-2012-005-10.diff v10 Links https://issues.asterisk.org/jira/browse/ASTERISK-19592 Asterisk Project Security Advisories are posted at http://www.asterisk.org/security This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2012-005.pdf and http://downloads.digium.com/pub/security/AST-2012-005.html Revision History Date Editor Revisions Made 04/16/2012 Matt Jordan Initial Release Asterisk Project Security Advisory - AST-2012-005 Copyright (c) 2012 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form. - ------------------------------------------------------------------------------ Asterisk Project Security Advisory - AST-2012-006 Product Asterisk Summary Remote Crash Vulnerability in SIP Channel Driver Nature of Advisory Remote Crash Susceptibility Remote Authenticated Sessions Severity Moderate Exploits Known No Reported On April 16, 2012 Reported By Thomas Arimont Posted On April 23, 2012 Last Updated On April 23, 2012 Advisory Contact Matt Jordan < mjordan AT digium DOT com > CVE Name Description A remotely exploitable crash vulnerability exists in the SIP channel driver if a SIP UPDATE request is processed within a particular window of time. For this to occur, the following must take place: 1. The setting 'trustrpid' must be set to True 2. An UPDATE request must be received after a call has been terminated and the associated channel object has been destroyed, but before the SIP dialog associated with the call has been destroyed. Receiving the UPDATE request before the call is terminated or after the SIP dialog associated with the call will not cause the crash vulnerability described here. 3. The UPDATE request must be formatted with the appropriate headers to reflect an Asterisk connected line update. The information in the headers must reflect a different Caller ID then what was previously associated with the dialog. When these conditions are true, Asterisk will attempt to perform a connected line update with no associated channel, and will crash. Resolution Asterisk now ensures a channel exists before performing a connected line update, when that connected line update is initiated via a SIP UPDATE request. In Asterisk versions not containing the fix for this issue, setting the 'trustrpid' setting to False will prevent this crash from occurring (default is False) Affected Versions Product Release Series Asterisk Open Source 1.8.x All versions Asterisk Open Source 10.x All versions Asterisk Business Edition C.3.x All versions Corrected In Product Release Asterisk Open Source 1.8.11.1, 10.3.1 Asterisk Business Edition C.3.7.4 Patches SVN URL Revision http://downloads.asterisk.org/pub/security/AST-2012-006-1.8.diff v1.8 http://downloads.asterisk.org/pub/security/AST-2012-006-10.diff v.10 Links https://issues.asterisk.org/jira/browse/ASTERISK-19770 Asterisk Project Security Advisories are posted at http://www.asterisk.org/security This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2012-006.pdf and http://downloads.digium.com/pub/security/AST-2012-006.html Revision History Date Editor Revisions Made 04/16/2012 Matt Jordan Initial release. Asterisk Project Security Advisory - AST-2012-006 Copyright (c) 2012 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form. ====================================================================== ========================================================= Serveur de référence du CERT-Renater https://services.renater.fr/ssi/ ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23 - 25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================