oss-security - Re: CVE Request -- Asterisk AST-2012-001 / Remote DoS while processing crypto line for media stream with non-existing RTP

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.GSO.4.64.1201201053330.12004@faron.mitre.org>
Date: Fri, 20 Jan 2012 10:55:20 -0500 (EST)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security@...ts.openwall.com
cc: "Steven M. Christey" <coley@...-smtp.mitre.org>,
        Joshua Colp <jcolp@...ium.com>
Subject: Re: CVE Request -- Asterisk AST-2012-001 / Remote
 DoS while processing crypto line for media stream with non-existing RTP


CVE-2012-0885 was already assigned to AST-2012-001 based on a request from 
the upstream vendor.  They probably updated their advisory since your 
initial request:

   http://downloads.asterisk.org/pub/security/AST-2012-001.html

- Steve


On Fri, 20 Jan 2012, Jan Lieskovsky wrote:

> Hello Kurt, Steve, vendors,
>
>  a denial of service flaw was found in the way asterisk processed certain
> requests to negotiate secure video stream, when the res_srtp Asterisk module
> has been loaded and video support has not been enabled. A remote attacker 
> could
> provide a specially-crafted media stream negotiation request, which once
> processed by Asterisk would lead to asterisk daemon crash by processing 
> crypto
> line for such media stream.
>
> References:
> [1] http://downloads.asterisk.org/pub/security/AST-2012-001.html
> [2] https://issues.asterisk.org/jira/browse/ASTERISK-19202
> [3] https://bugzilla.redhat.com/show_bug.cgi?id=783487
>
> Upstream patch against the v1.8.x branch:
> [4] http://downloads.asterisk.org/pub/security/AST-2012-001-1.8.diff
>
> Upstream patch against the v1.10.x branch:
> [5] http://downloads.asterisk.org/pub/security/AST-2012-001-10.diff
>
> Could you allocate a CVE identifier for this?
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.