Asterisk STUN, Skinny Channel Driver, and IAX2 Channel Driver Bugs Let Remote Users Deny Service or Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1018407
|
|
SecurityTracker URL: http://securitytracker.com/id?1018407
|
|
CVE Reference: CVE-2007-3762
, CVE-2007-3763
, CVE-2007-3764
, CVE-2007-3765
(Links to External Site)
|
Date: Jul 18 2007
|
Impact: Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 1.2.22 and 1.4.8
|
Description: Several vulnerabilities were reported in Asterisk. A remote user can cause denial of service conditions. A remote user can execute arbitrary code on the target system.
A remote user can send a specially crafted RTP frame to trigger a stack overflow in the IAX2 channel driver and execute arbitrary
code on the target system [CVE-2007-3762]. The code will run with the privileges of the target service.
Russell Bryant of Digium,
Inc. discovered this vulnerability on July 12, 2007.
A remote user can send a specially crafted LAGRQ or LAGRP frame to trigger
a crash in the target service [CVE-2007-3763].
The vendor was notified on July 13, 2007. Chris Clark and Zane Lackey of iSEC
Partners reported this vulnerability.
A remote user can send a specially crafted packet where the declared packet data length
is between 0 and 3 but the actual length is 4 or more bytes larger to trigger a large memcpy in the Skinny channel driver and cause
denial of service conditions [CVE-2007-3764]. The vendor notes that the impact of this vulnerability has not been investigated.
The
vendor was notified on July 13, 2007. Will Drewry of the Google Security Team reported this vulnerability.
A remote user can
send a specially crafted STUN packet via RTP to trigger a crash [CVE-2007-3765].
The vendor was notified on July 13, 2007.
Will Drewry of the Google Security Team reported this vulnerability.
|
Impact: A remote user can cause the target service to crash.
A remote user can execute arbitrary code on the target system.
|
Solution: The vendor has issued fixed versions for the various editions of Asterisk.
The Asterisk advisories are available at:
http://ftp.digium.com/pub/asa/ASA-2007-014.pdf
http://ftp.digium.com/pub/asa/ASA-2007-015.pdf
http://ftp.digium.com/pub/asa/ASA-2007-016.pdf
http://ftp.digium.com/pub/asa/ASA-2007-017.pdf
|
Vendor URL: ftp.digium.com/pub/asa/ASA-2007-014.pdf (Links to External Site)
|
Cause: Boundary error, Input validation error, State error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 17 Jul 2007 23:38:07 -0400
Subject: Asterisk
|
ASA-2007-017 - Remote Crash Vulnerability in STUN implementation
ASA-2007-016 - Remote Crash Vulnerability in Skinny channel driver
ASA-2007-015 - Remote Crash Vulnerability in IAX2 Channel Driver
ASA-2007-014 - Stack Buffer Overflow in IAX2 channel driver
CVE-2007-3762
CVE-2007-3763
CVE-2007-3764
CVE-2007-3765
|
|
