==================================================================== CERT-Renater Note d'Information No. 2012/VULN264 ____________________________________________________________________ DATE : 06/07/2012 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Asterisk Open Source versions 1.8.x, 10.x, Asterisk Business Edition versions C.3.x, Certified Asterisk versions 1.8.11-certx, Asterisk Digiumphones versions 10.x.x-digiumphones. ====================================================================== http://downloads.asterisk.org/pub/security/AST-2012-010.html http://downloads.asterisk.org/pub/security/AST-2012-011.txt ______________________________________________________________________ Asterisk Project Security Advisory - AST-2012-010 Product Asterisk Summary Possible resource leak on uncompleted re-invite transactions Nature of Advisory Denial of Service Susceptibility Remote authenticated sessions Severity Minor Exploits Known No Reported On June 13, 2012 Reported By Steve Davies Posted On July 5, 2012 Last Updated On July 5, 2012 Advisory Contact Terry Wilson CVE Name TBD Description If Asterisk sends a re-invite and an endpoint responds to the re-invite with a provisional response but never sends a final response, then the SIP dialog structure is never freed and the RTP ports for the call are never released. If an attacker has the ability to place a call, they could create a denial of service by using all available RTP ports. Resolution A re-invite that receives a provisional response without a final response is detected and properly cleaned up at hangup. Affected Versions Product Release Series Asterisk Open Source 1.8.x All versions Asterisk Open Source 10.x All versions Asterisk Business Edition C.3.x All versions Certified Asterisk 1.8.11-certx All versions Asterisk Digiumphones 10.x.x-digiumphones All versions Corrected In Product Release Asterisk Open Source 1.8.13.1, 10.5.2 Asterisk Business Edition C.3.7.5 Certified Asterisk 1.8.11-cert4 Asterisk Digiumphones 10.5.2-digiumphones Patches URL Revision http://downloads.asterisk.org/pub/security/ AST-2012-010-1.8.diff Asterisk 1.8 http://downloads.asterisk.org/pub/security/ AST-2012-010-10.diff Asterisk 10 Links https://issues.asterisk.org/jira/browse/ASTERISK-19992 Asterisk Project Security Advisories are posted at http://www.asterisk.org/security This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security /AST-2012-010.pdf and http://downloads.digium.com/pub/security /AST-2012-010.html Revision History Date Editor Revisions Made 06/27/2012 Terry Wilson Initial Release ______________________________________________________________________ Asterisk Project Security Advisory - AST-2012-011 Product Asterisk Summary Remote crash vulnerability in voice mail application Nature of Advisory Denial of Service Susceptibility Remote authenticated sessions Severity Moderate Exploits Known No Reported On June 13, 2012 Reported By Nicolas Bouliane - Avencall Security Labs Posted On June 27, 2012 Last Updated On July 5, 2012 Advisory Contact Kinsey Moore CVE Name CVE-2012-3812 Description If a single voicemail account is manipulated by two parties simultaneously, a condition can occur where memory is freed twice causing a crash. Resolution Management of the memory in question has been reworked so that double frees and out of bounds array access do not occur. Upgrade to the latest release. Affected Versions Product Release Series Asterisk Open Source 1.8.x 1.8.11 and newer Asterisk Open Source 10.x 10.3 and newer Certified Asterisk 1.8.11-certx All versions Asterisk Digiumphones 10.x.x-digiumphones All versions Corrected In Product Release Asterisk Open Source 1.8.13.1, 10.5.2 Certified Asterisk 1.8.11-cert4 Asterisk Digiumphones 10.5.2-digiumphones Patches URL Revision http://downloads.asterisk.org/pub/security/AST-2012-011-1.8.diff Asterisk 1.8, Certified Asterisk http://downloads.asterisk.org/pub/security/AST-2012-011-10.diff Asterisk 10, Asterisk Digiumphones Links https://issues.asterisk.org/jira/browse/ASTERISK-20052 Asterisk Project Security Advisories are posted at http://www.asterisk.org/security This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2012-011.pdf and http://downloads.digium.com/pub/security/AST-2012-011.html Revision History Date Editor Revisions Made 06/27/2012 Kinsey Moore Initial Release Asterisk Project Security Advisory - AST-2012-011 Copyright (c) 2012 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form. ====================================================================== ========================================================= Serveur de référence du CERT-Renater https://services.renater.fr/ssi/ ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23 - 25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================