SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

Resource Exhaustion Vulnerability in Asterisk SIP channel driver


Arrow  SecurityAlert : 3047
Arrow  CVE : CVE-2007-4455
Arrow  SecurityRisk : Medium  Security Risk Medium  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Exploit Available : Yes
Arrow  Credit : Asterisk Security Team
Arrow  Published : 23.08.2007

Arrow  Affected Software : Asterisk x



Arrow  Advisory Content :  

Asterisk Project Security Advisory - AST-2007-020


+------------------------------------------------------------------------+
| Product | Asterisk
|

|--------------------+---------------------------------------------------|
| Summary | Resource Exhaustion vulnerability in SIP channel
|
| | driver
|

|--------------------+---------------------------------------------------|
| Nature of Advisory | Denial of Service
|

|--------------------+---------------------------------------------------|
| Susceptibility | Remote Unauthenticated Sessions
|

|--------------------+---------------------------------------------------|
| Severity | Moderate
|

|--------------------+---------------------------------------------------|
| Exploits Known | No
|

|--------------------+---------------------------------------------------|
| Reported On | August 9, 2007
|

|--------------------+---------------------------------------------------|
| Reported By | Jon Moldenauer (bugs.digium.com user
|
| | jmoldenhauer)
|

|--------------------+---------------------------------------------------|
| Posted On | August 21, 2007
|

|--------------------+---------------------------------------------------|
| Last Updated On | August 21, 2007
|

|--------------------+---------------------------------------------------|
| Advisory Contact | Russell Bryant
<russell_at_digium.<!--nospam-->com> |

|--------------------+---------------------------------------------------|
| CVE Name | CVE-2007-4455
|

+------------------------------------------------------------------------+


+------------------------------------------------------------------------+
| Description | The handling of SIP dialog history was broken during the
|
| | development of Asterisk 1.4. Regardless of whether
|
| | recording SIP dialog history is turned on or off, the
|
| | history is still recorded in memory. Furthermore, there
|
| | is no upper limit on how many history items will be
|
| | stored for a given SIP dialog.
|
| |
|
| | It is possible for an attacker to use up all of the
|
| | system's memory by creating a SIP dialog that records
|
| | many entires in the history and never ends. It is also
|
| | worth noting for the sake of doing the math to calculate
|
| | what it would take to exploit this that each SIP history
|
| | entry will take up a maximum of 88 bytes.
|

+------------------------------------------------------------------------+


+------------------------------------------------------------------------+
| Resolution | The fix that has been added to chan_sip is to restore the
|
| | functionality where SIP dialog history is not recorded in
|
| | memory if it is not enabled. Furthermore, a maximum of 50
|
| | entires in the history will be stored for each dialog
|
| | when recording history is turned on.
|
| |
|
| | The only way to avoid this problem in affected versions
|
| | of Asterisk is to disable chan_sip. If chan_sip is being
|
| | used, the system must be upgraded to a version that has
|
| | this issue resolved.
|

+------------------------------------------------------------------------+


+------------------------------------------------------------------------+
| Affected Versions
|

|------------------------------------------------------------------------|
| Product | Release |
|
| | Series |
|

|----------------------------------+-------------+-----------------------|
| Asterisk Open Source | 1.0.x | Not affected
|

|----------------------------------+-------------+-----------------------|
| Asterisk Open Source | 1.2.x | Not affected
|

|----------------------------------+-------------+-----------------------|
| Asterisk Open Source | 1.4.x | All versions prior to
|
| | | 1.4.11
|

|----------------------------------+-------------+-----------------------|
| Asterisk Business Edition | A.x.x | Not affected
|

|----------------------------------+-------------+-----------------------|
| Asterisk Business Edition | B.x.x | Not affected
|

|----------------------------------+-------------+-----------------------|
| AsteriskNOW | pre-release | All versions prior to
|
| | | beta7
|

|----------------------------------+-------------+-----------------------|
| Asterisk Appliance Developer Kit | 0.x.x | All versions prior to
|
| | | 0.8.0
|

|----------------------------------+-------------+-----------------------|
| s800i (Asterisk Appliance) | 1.0.x | All versions prior to
|
| | | 1.0.3
|

+------------------------------------------------------------------------+


+------------------------------------------------------------------------+
| Corrected In
|

|------------------------------------------------------------------------|
| Product | Release
|

|---------------+--------------------------------------------------------|
| Asterisk Open | 1.4.11, available from
|
| Source | http://downloads.digium.com/pub/telephony/asterisk
|

|---------------+--------------------------------------------------------|
| AsteriskNOW | Beta7, available from http://www.asterisknow.org/.
|
| | Beta5 and Beta6 users can update using the system
|
| | update feature in the appliance control panel.
|

|---------------+--------------------------------------------------------|
| Asterisk | 0.8.0, available from
|
| Appliance | http://downloads.digium.com/pub/telephony/aadk
|
| Developer Kit |
|

|---------------+--------------------------------------------------------|
| s800i | 1.0.3
|
| (Asterisk |
|
| Appliance) |
|

+------------------------------------------------------------------------+


+------------------------------------------------------------------------+
| Links | http://bugs.digium.com/view.php?id=10421
|
| |
|
| | http://bugs.digium.com/view.php?id=10418
|

+------------------------------------------------------------------------+


+------------------------------------------------------------------------+
| Asterisk Project Security Advisories are posted at
|
| http://www.asterisk.org/security.
|
|
|
| This document may be superseded by later versions; if so, the latest
|
| version will be posted at
|
| http://downloads.digium.com/pub/asa/AST-2007-020.pdf and
|
| http://downloads.digium.com/pub/asa/AST-2007-020.html.
|

+------------------------------------------------------------------------+


+------------------------------------------------------------------------+
| Revision History
|

|------------------------------------------------------------------------|
| Date | Editor | Revisions Made
|

|---------------------+------------------------+-------------------------|
| August 21, 2007 | russell_at_digium.<!--nospam-->com | Initial
Release |

+------------------------------------------------------------------------+

Asterisk Project Security Advisory - AST-2007-020
Copyright (c) 2007 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in
its
original, unaltered form.





Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc/fnmatch(3) DoS

Security Risk Medium- 2011-05-13

Allow attacker to denial of service apache 2.2.17 server
Apache RSS Apache Alert

» Apache HTTP Server Denial
   of Service Vulnerability

» Multiple Vendors
   libc/fnmatch(3) DoS (incl
   apache poc)

» Apache Continuum
   cross-site scripting
   vulnerability

» Apache Tomcat DoS
   Vulnerability
PHP RSS PHP Alert

» PHP Hashtables Denial of
   Service

» PHP 5.3.6 multiple null
   pointer dereference

» PHP 5.3.6 ZipArchive
   invalid use glob(3)

» libzip 0.9.3
   _zip_name_locate NULL
   Pointer Dereference (incl
   PHP 5.3.5)
ADT

Protect your family and valuables with Home Security Systems
Copyright © SecurityReason.com. All Rights Reserved.