SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (VoIP)  >   Asterisk Vendors:   Digium (Linux Support Services)
Asterisk STUN, Skinny Channel Driver, and IAX2 Channel Driver Bugs Let Remote Users Deny Service or Execute Arbitrary Code
SecurityTracker Alert ID:  1018407
SecurityTracker URL:  http://securitytracker.com/id/1018407
CVE Reference:   CVE-2007-3762, CVE-2007-3763, CVE-2007-3764, CVE-2007-3765   (Links to External Site)
Date:  Jul 18 2007
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 1.2.22 and 1.4.8
Description:   Several vulnerabilities were reported in Asterisk. A remote user can cause denial of service conditions. A remote user can execute arbitrary code on the target system.

A remote user can send a specially crafted RTP frame to trigger a stack overflow in the IAX2 channel driver and execute arbitrary code on the target system [CVE-2007-3762]. The code will run with the privileges of the target service.

Russell Bryant of Digium, Inc. discovered this vulnerability on July 12, 2007.

A remote user can send a specially crafted LAGRQ or LAGRP frame to trigger a crash in the target service [CVE-2007-3763].

The vendor was notified on July 13, 2007. Chris Clark and Zane Lackey of iSEC Partners reported this vulnerability.

A remote user can send a specially crafted packet where the declared packet data length is between 0 and 3 but the actual length is 4 or more bytes larger to trigger a large memcpy in the Skinny channel driver and cause denial of service conditions [CVE-2007-3764]. The vendor notes that the impact of this vulnerability has not been investigated.

The vendor was notified on July 13, 2007. Will Drewry of the Google Security Team reported this vulnerability.

A remote user can send a specially crafted STUN packet via RTP to trigger a crash [CVE-2007-3765].

The vendor was notified on July 13, 2007. Will Drewry of the Google Security Team reported this vulnerability.

Impact:   A remote user can cause the target service to crash.

A remote user can execute arbitrary code on the target system.

Solution:   The vendor has issued fixed versions for the various editions of Asterisk.

The Asterisk advisories are available at:

http://ftp.digium.com/pub/asa/ASA-2007-014.pdf
http://ftp.digium.com/pub/asa/ASA-2007-015.pdf
http://ftp.digium.com/pub/asa/ASA-2007-016.pdf
http://ftp.digium.com/pub/asa/ASA-2007-017.pdf

Vendor URL:  ftp.digium.com/pub/asa/ASA-2007-014.pdf (Links to External Site)
Cause:   Boundary error, Input validation error, State error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC