SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (VoIP)  >   Asterisk Vendors:   Digium (Linux Support Services)
Asterisk res_fax_spandsp Module Processing Flaw Lets Remote Authenticated Users Deny Service
SecurityTracker Alert ID:  1030876
SecurityTracker URL:  http://securitytracker.com/id/1030876
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Sep 18 2014
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to versions 11.12.1, 12.5.1
Description:   A vulnerability was reported in Asterisk. A remote authenticated user can cause denial of service conditions.

A remote authenticated user can send a specially crafted out-of-call message to trigger a crash if the channel servicing the message is sent to the ReceiveFax dialplan application when using the res_fax_spandsp module.

The res_fax_digium module is not affected.

The vendor was notified on September 5, 2014.

Philippe Lindheimer reported this vulnerability.

Impact:   A remote authenticated user can cause the target service to crash.
Solution:   The vendor has issued a fix (11.12.1, 12.5.1; 11.6-cert6).

The vendor's advisory is available at:

http://downloads.asterisk.org/pub/security/AST-2014-010.html

Cause:   State error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents

Subject:  [FD] AST-2014-010: Remote crash when handling out of call message in certain dialplan configurations

               Asterisk Project Security Advisory - AST-2014-010

         Product        Asterisk                                              
         Summary        Remote crash when handling out of call message in     
                        certain dialplan configurations                       
    Nature of Advisory  Remotely triggered crash of Asterisk                  
      Susceptibility    Remote authenticated sessions                         
         Severity       Minor                                                 
      Exploits Known    No                                                    
       Reported On      05 September 2014                                     
       Reported By      Philippe Lindheimer                                   
        Posted On       18 September 2014                                     
     Last Updated On    September 18, 2014                                    
     Advisory Contact   Matt Jordan <mjordan AT digium DOT com>               
         CVE Name       Pending                                               

    Description  When an out of call message - delivered by either the SIP    
                 or PJSIP channel driver or the XMPP stack - is handled in    
                 Asterisk, a crash can occur if the channel servicing the     
                 message is sent into the ReceiveFax dialplan application     
                 while using the res_fax_spandsp module.                      
                                                                              
                 Note that this crash does not occur when using the           
                 res_fax_digium module.                                       
                                                                              
                 While this crash technically occurs due to a configuration   
                 issue, as attempting to receive a fax from a channel driver  
                 that only contains textual information will never succeed,   
                 the likelihood of having it occur is sufficiently high as    
                 to warrant this advisory.                                    

    Resolution  The fax family of applications have been updated to handle    
                the Message channel driver correctly. Users using the fax     
                family of applications along with the out of call text        
                messaging features are encouraged to upgrade their versions   
                of Asterisk to the versions specified in this security        
                advisory.                                                     
                                                                              
                Additionally, users of Asterisk are encouraged to use a       
                separate dialplan context to process text messages. This      
                avoids issues where the Message channel driver is passed to   
                dialplan applications that assume a media stream is           
                available. Note that the various channel drivers and stacks   
                provide such an option; an example being the SIP channel      
                driver's outofcall_message_context option.                    

                               Affected Versions       
                         Product                       Release  
                                                       Series   
                  Asterisk Open Source                  11.x    All versions  
                  Asterisk Open Source                  12.x    All versions  
                   Certified Asterisk                   11.6    All versions  

                                  Corrected In               
                            Product                              Release      
                     Asterisk Open Source                    11.12.1, 12.5.1  
                      Certified Asterisk                       11.6-cert6     

                                     Patches                         
                                SVN URL                              Revision  
   http://downloads.asterisk.org/pub/security/AST-2014-010-11.diff   Asterisk  
                                                                     11        
   http://downloads.asterisk.org/pub/security/AST-2014-010-12.diff   Asterisk  
                                                                     12        
   http://downloads.asterisk.org/pub/security/AST-2014-010-11.6.diff Certified 
                                                                     Asterisk  
                                                                     11.6      

    Links  https://issues.asterisk.org/jira/browse/ASTERISK-24301             

    Asterisk Project Security Advisories are posted at                        
    http://www.asterisk.org/security                                          
                                                                              
    This document may be superseded by later versions; if so, the latest      
    version will be posted at                                                 
    http://downloads.digium.com/pub/security/AST-2014-010.pdf and             
    http://downloads.digium.com/pub/security/AST-2014-010.html                

                                Revision History
          Date                  Editor                 Revisions Made         
    September 18       Matt Jordan               Initial Draft                

               Asterisk Project Security Advisory - AST-2014-010
              Copyright (c) 2014 Digium, Inc. All Rights Reserved.
  Permission is hereby granted to distribute and publish this advisory in its
                           original, unaltered form.


_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC