oss-security - CVE Request -- Asterisk: Stack-based buffer overflow by forming an outgoing SIP request with specially-crafted caller ID information (AST-2011-001)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4D36C719.3070200@redhat.com>
Date: Wed, 19 Jan 2011 12:12:25 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>,
        Matthew Nicholson <mnicholson@...ium.com>
CC: oss-security <oss-security@...ts.openwall.com>
Subject: CVE Request -- Asterisk: Stack-based buffer overflow by forming an
 outgoing SIP request with specially-crafted caller ID information (AST-2011-001)

Hi Josh, Steve, vendors,

   Asterisk upstream yesterday released AST-2011-001, also with patches for supported versions.
   References:
   [1] http://downloads.asterisk.org/pub/security/AST-2011-001.html
   [2] http://seclists.org/fulldisclosure/2011/Jan/297
   [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610487
   [4] https://bugzilla.redhat.com/show_bug.cgi?id=670777

Could you allocate CVE id for this?

Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.