SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
Search :
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

Resource Exhaustion Vulnerability in Asterisk SIP channel driver


Arrow  SecurityAlert : 3047
Arrow  CVE : CVE-2007-4455
Arrow  SecurityRisk : Medium  Security Risk Medium  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Exploit Given : Yes
Arrow  Credit : Asterisk Security Team
Arrow  Published : 23.08.2007

Arrow  Affected Software : Asterisk x



Arrow  Advisory Text :  

Asterisk Project Security Advisory - AST-2007-020


+------------------------------------------------------------------------+
| Product | Asterisk
|

|--------------------+---------------------------------------------------|
| Summary | Resource Exhaustion vulnerability in SIP channel
|
| | driver
|

|--------------------+---------------------------------------------------|
| Nature of Advisory | Denial of Service
|

|--------------------+---------------------------------------------------|
| Susceptibility | Remote Unauthenticated Sessions
|

|--------------------+---------------------------------------------------|
| Severity | Moderate
|

|--------------------+---------------------------------------------------|
| Exploits Known | No
|

|--------------------+---------------------------------------------------|
| Reported On | August 9, 2007
|

|--------------------+---------------------------------------------------|
| Reported By | Jon Moldenauer (bugs.digium.com user
|
| | jmoldenhauer)
|

|--------------------+---------------------------------------------------|
| Posted On | August 21, 2007
|

|--------------------+---------------------------------------------------|
| Last Updated On | August 21, 2007
|

|--------------------+---------------------------------------------------|
| Advisory Contact | Russell Bryant
<russell_at_digium.<!--nospam-->com> |

|--------------------+---------------------------------------------------|
| CVE Name | CVE-2007-4455
|

+------------------------------------------------------------------------+


+------------------------------------------------------------------------+
| Description | The handling of SIP dialog history was broken during the
|
| | development of Asterisk 1.4. Regardless of whether
|
| | recording SIP dialog history is turned on or off, the
|
| | history is still recorded in memory. Furthermore, there
|
| | is no upper limit on how many history items will be
|
| | stored for a given SIP dialog.
|
| |
|
| | It is possible for an attacker to use up all of the
|
| | system's memory by creating a SIP dialog that records
|
| | many entires in the history and never ends. It is also
|
| | worth noting for the sake of doing the math to calculate
|
| | what it would take to exploit this that each SIP history
|
| | entry will take up a maximum of 88 bytes.
|

+------------------------------------------------------------------------+


+------------------------------------------------------------------------+
| Resolution | The fix that has been added to chan_sip is to restore the
|
| | functionality where SIP dialog history is not recorded in
|
| | memory if it is not enabled. Furthermore, a maximum of 50
|
| | entires in the history will be stored for each dialog
|
| | when recording history is turned on.
|
| |
|
| | The only way to avoid this problem in affected versions
|
| | of Asterisk is to disable chan_sip. If chan_sip is being
|
| | used, the system must be upgraded to a version that has
|
| | this issue resolved.
|

+------------------------------------------------------------------------+


+------------------------------------------------------------------------+
| Affected Versions
|

|------------------------------------------------------------------------|
| Product | Release |
|
| | Series |
|

|----------------------------------+-------------+-----------------------|
| Asterisk Open Source | 1.0.x | Not affected
|

|----------------------------------+-------------+-----------------------|
| Asterisk Open Source | 1.2.x | Not affected
|

|----------------------------------+-------------+-----------------------|
| Asterisk Open Source | 1.4.x | All versions prior to
|
| | | 1.4.11
|

|----------------------------------+-------------+-----------------------|
| Asterisk Business Edition | A.x.x | Not affected
|

|----------------------------------+-------------+-----------------------|
| Asterisk Business Edition | B.x.x | Not affected
|

|----------------------------------+-------------+-----------------------|
| AsteriskNOW | pre-release | All versions prior to
|
| | | beta7
|

|----------------------------------+-------------+-----------------------|
| Asterisk Appliance Developer Kit | 0.x.x | All versions prior to
|
| | | 0.8.0
|

|----------------------------------+-------------+-----------------------|
| s800i (Asterisk Appliance) | 1.0.x | All versions prior to
|
| | | 1.0.3
|

+------------------------------------------------------------------------+


+------------------------------------------------------------------------+
| Corrected In
|

|------------------------------------------------------------------------|
| Product | Release
|

|---------------+--------------------------------------------------------|
| Asterisk Open | 1.4.11, available from
|
| Source | http://downloads.digium.com/pub/telephony/asterisk
|

|---------------+--------------------------------------------------------|
| AsteriskNOW | Beta7, available from http://www.asterisknow.org/.
|
| | Beta5 and Beta6 users can update using the system
|
| | update feature in the appliance control panel.
|

|---------------+--------------------------------------------------------|
| Asterisk | 0.8.0, available from
|
| Appliance | http://downloads.digium.com/pub/telephony/aadk
|
| Developer Kit |
|

|---------------+--------------------------------------------------------|
| s800i | 1.0.3
|
| (Asterisk |
|
| Appliance) |
|

+------------------------------------------------------------------------+


+------------------------------------------------------------------------+
| Links | http://bugs.digium.com/view.php?id=10421
|
| |
|
| | http://bugs.digium.com/view.php?id=10418
|

+------------------------------------------------------------------------+


+------------------------------------------------------------------------+
| Asterisk Project Security Advisories are posted at
|
| http://www.asterisk.org/security.
|
|
|
| This document may be superseded by later versions; if so, the latest
|
| version will be posted at
|
| http://downloads.digium.com/pub/asa/AST-2007-020.pdf and
|
| http://downloads.digium.com/pub/asa/AST-2007-020.html.
|

+------------------------------------------------------------------------+


+------------------------------------------------------------------------+
| Revision History
|

|------------------------------------------------------------------------|
| Date | Editor | Revisions Made
|

|---------------------+------------------------+-------------------------|
| August 21, 2007 | russell_at_digium.<!--nospam-->com | Initial
Release |

+------------------------------------------------------------------------+

Asterisk Project Security Advisory - AST-2007-020
Copyright (c) 2007 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in
its
original, unaltered form.




Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

Multiple Vendors libc/gdtoa printf(3) Array Overrun

Security Risk High- 2009-05-30

SecurityReason realised new advisory about vulnerabilities libc/gdtoa...
Apache RSS Apache Alert

» Apache Tomcat
   RequestDispatcher
   directory traversal
   vulnerability

» Apache mod_dav / svn
   Remote Denial of Service
   Exploit

» Apache Tomcat Information
   disclosure

» Apache Tomcat User
   enumeration vulnerability
   with FORM authentication
PHP RSS PHP Alert

» PHP 5.2.9 curl safe_mode
   & open_basedir bypass

» PHP 5.2.6 SAPI
   php_getuid() overload

» PHP
   ZipArchive::extractTo()
   Directory Traversal
   Vulnerability

» PHP 5.2.6 dba_replace()
   destroying file
Copyright © SecurityReason.com. All Rights Reserved.