Date: Fri, 09 Dec 2011 13:00:36 +0100 From: Jan Lieskovsky <jlieskov@...hat.com> To: "Steven M. Christey" <coley@...us.mitre.org> CC: oss-security@...ts.openwall.com, Asterisk Development Team <asteriskteam@...ium.com> Subject: CVE Request -- Asterisk -- AST-2011-013 and AST-2011-014 Hello Kurt, Steve, vendors, the following two security flaws have been recently fixed: http://www.asterisk.org/node/51693 in Asterisk: 1) AST-2011-013 Possible to enumerate SIP usernames when general and user/peer NAT settings differed An information disclosure flaw was found in the way Asterisk handled UDP requests in configurations using network address translation (NAT) for the SIP protocol. When the general configuration file section and user / peer configuration file section NAT settings differed, it was possible to enumerate SIP usernames if the request was sent to different port as that, specified in the Via header. References:  http://www.asterisk.org/node/51693  http://downloads.asterisk.org/pub/security/AST-2011-013.pdf  http://lists.digium.com/pipermail/asterisk-dev/2011-November/thread.html#52191  https://bugs.gentoo.org/show_bug.cgi?id=394095  https://bugzilla.redhat.com/show_bug.cgi?id=765773 Upstream bug report:  https://issues.asterisk.org/jira/browse/ASTERISK-18862 Upstream review board request:  https://reviewboard.asterisk.org/r/1591/ Upstream patch (for 1.8 branch):  http://svnview.digium.com/svn/asterisk?view=revision&sortby=date&revision=345828 2) AST-2011-014 NULL pointer dereference (crash) when processing INFO automon message with no channel A NULL pointer dereference flaw was found in the way Asterisk handled INFO requests, when the 'automon' feature was enabled. If no channel had been created yet, a remote attacker could use this flaw to cause a denial of service (asterisk crash) by sending an INFO request. References:  http://www.asterisk.org/node/51693  http://downloads.asterisk.org/pub/security/AST-2011-014.pdf  https://bugs.gentoo.org/show_bug.cgi?id=394095  https://bugzilla.redhat.com/show_bug.cgi?id=765776 Upstream patch (for 1.8 branch):  http://svnview.digium.com/svn/asterisk?view=revision&sortby=date&revision=347533 Could you allocate CVE ids for these? Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ