[NEWS] Skinny Channel Driver DoS

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Skinny Channel Driver DoS
------------------------------------------------------------------------


SUMMARY

The Asterisk Skinny channel driver, chan_skinny, has a remotely
exploitable crash vulnerability. A segfault can occur when Asterisk
receives a "CAPABILITIES_RES_MESSAGE" packet where the capabilities count
is greater than the total number of items in the capabilities_res_message
array. Note that this requires an authenticated session.

DETAILS

Vulnerable Systems:
* Asterisk Open Source 1.4.x - all versions prior to 1.4.10
* AsteriskNOW all versions prior to beta7
* Asterisk Appliance Developer Kit all versions prior to 0.7.0
* s800i (Asterisk Appliance) all versions prior to 1.0.3

Immune Systems:
* Asterisk Open Source 1.4.x - version 1.4.10
* AsteriskNOW beta7
* Asterisk Appliance Developer Kit 0.7.0
* s800i (Asterisk Appliance) 1.0.3
* Asterisk Open Source 1.0.x
* Asterisk Open Source 1.2.x

Resolution:
Asterisk code has been modified to limit the incoming capabilities count.

Users with configured Skinny devices should upgrade to the appropriate
version listed in the corrected in section of this advisory.


ADDITIONAL INFORMATION

The information has been provided by <mailto:security@xxxxxxxxxxxx>
Security Response Team.
The original article can be found at:
<http://downloads.digium.com/pub/asa/ASA-2007-019.html>
http://downloads.digium.com/pub/asa/ASA-2007-019.html



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [UNIX] IAX2 Channel Driver Resource Exhaustion Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The IAX2 channel driver in Asterisk is vulnerable to a Denial of Service ...
    (Securiteam)
  • [UNIX] Asterisk Skinny Unauthenticated Heap Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Asterisk Skinny Unauthenticated Heap Overflow ... Asterisk is "The Opensource PBX", ... Asterisk version 1.2.12.1 and prior ...
    (Securiteam)
  • [NEWS] Remote Crash Vulnerability in Asterisks Skinny Channel Driver
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Remote Crash Vulnerability in Asterisk's Skinny Channel Driver ... Asterisk Open Source versions prior to 1.4.8 ...
    (Securiteam)
  • [NEWS] IAX2 Incomplete 3-Way Handshake (Spoofing)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... IAX2 Incomplete 3-Way Handshake ... Asterisk Business Edition A.x.x - all versions ... of the ACK response and that the ACK response could be spoofed, ...
    (Securiteam)
  • [NEWS] Remote Crash Vulnerability in Asterisks STUN Implementation
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Remote Crash Vulnerability in Asterisk's STUN Implementation ... if Asterisk receives a specially crafted STUN packet on an active RTP ...
    (Securiteam)