Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:19986
HistoryJun 07, 2008 - 12:00 a.m.

AST-2008-009: (Corrected subject) Remote crash vulnerability in ooh323 channel driver

2008-06-0700:00:00
vulners.com
7
           Asterisk Project Security Advisory - AST-2008-009

±-----------------------------------------------------------------------+
| Product | Asterisk-Addons |
|--------------------±--------------------------------------------------|
| Summary | Remote crash vulnerability in ooh323 channel |
| | driver |
|--------------------±--------------------------------------------------|
| Nature of Advisory | Remote crash |
|--------------------±--------------------------------------------------|
| Susceptibility | Remote unauthenticated sessions |
|--------------------±--------------------------------------------------|
| Severity | Major |
|--------------------±--------------------------------------------------|
| Exploits Known | No |
|--------------------±--------------------------------------------------|
| Reported On | May 29, 2008 |
|--------------------±--------------------------------------------------|
| Reported By | Tzafrir Cohen <tzafrir DOT cohen AT xorcom DOT |
| | com> |
|--------------------±--------------------------------------------------|
| Posted On | June 4, 2008 |
|--------------------±--------------------------------------------------|
| Last Updated On | June 4, 2008 |
|--------------------±--------------------------------------------------|
| Advisory Contact | Mark Michelson <mmichelson AT digium DOT com> |
|--------------------±--------------------------------------------------|
| CVE Name | CVE-2008-2543 |
±-----------------------------------------------------------------------+

±-----------------------------------------------------------------------+
| Description | The ooh323 channel driver provided in Asterisk Addons |
| | used a TCP connection to pass commands internally. The |
| | payload of these packets included addresses of memory |
| | which were to be freed after the command was processed. |
| | By sending arbitrary data to the listening TCP socket, |
| | one could cause an almost certain crash since the |
| | command handler would attempt to free invalid memory. |
| | This problem was made worse by the fact that the |
| | listening TCP socket was bound to whatever IP address |
| | was specified by the "bindaddr" option in ooh323.conf |
±-----------------------------------------------------------------------+

±-----------------------------------------------------------------------+
| Resolution | The TCP connection used by ooh323 has been replaced with |
| | a pipe. The effect of this change is that data from |
| | outside the ooh323 process may not be injected. |
±-----------------------------------------------------------------------+

±-----------------------------------------------------------------------+

Affected Versions
Product
----------------------------------±------------±----------------------
Asterisk Open Source
----------------------------------±------------±----------------------
Asterisk Open Source
----------------------------------±------------±----------------------
Asterisk Open Source
----------------------------------±------------±----------------------
Asterisk Addons
----------------------------------±------------±----------------------
Asterisk Addons
----------------------------------±------------±----------------------
Asterisk Business Edition
----------------------------------±------------±----------------------
Asterisk Business Edition
----------------------------------±------------±----------------------
Asterisk Business Edition
----------------------------------±------------±----------------------
AsteriskNOW
----------------------------------±------------±----------------------
Asterisk Appliance Developer Kit
----------------------------------±------------±----------------------
s800i (Asterisk Appliance)
±-----------------------------------------------------------------------+

±-----------------------------------------------------------------------+

Corrected In
Product
------------------------------------------±----------------------------
Asterisk Addons 1.2
------------------------------------------±----------------------------
Asterisk-Addons 1.4
------------------------------------------±----------------------------
±-----------------------------------------------------------------------+

±-----------------------------------------------------------------------+
| Links | |
±-----------------------------------------------------------------------+

±-----------------------------------------------------------------------+
| Asterisk Project Security Advisories are posted at |
| http://www.asterisk.org/security |
| |
| This document may be superseded by later versions; if so, the latest |
| version will be posted at |
| http://downloads.digium.com/pub/security/AST-2008-009.pdf and |
| http://downloads.digium.com/pub/security/AST-2008-009.html |
±-----------------------------------------------------------------------+

±-----------------------------------------------------------------------+

Revision History
Date
-------------------±---------------------±----------------------------
Jun 3, 2008
±-----------------------------------------------------------------------+
           Asterisk Project Security Advisory - AST-2008-009
          Copyright &#40;c&#41; 2008 Digium, Inc. All Rights Reserved.

Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.

Related for SECURITYVULNS:DOC:19986