Critical Update: Asterisk 1.2.22 und 1.4.8

[betateilchen]

The Asterisk development team has released
Asterisk versions 1.2.22 and 1.4.8.

These releases contain fixes for four critical security vulnerabilities.
One of these vulnerabilities is a remotely exploitable stack buffer
overflow, which could allow an attacker to execute arbitrary code on the
target machine. The other three are all remotely exploitable crash
vulnerabilities.

So schnell kann man doch seine Server gar nicht updaten, wie die neue Versionen rausschmeissen :motz:

 

[kombjuder]

So schnell kann man doch seine Server gar nicht updaten, wie die neue Versionen rausschmeissen :motz:

Besser so, als wie bei einem verbreiteten Betriebssytem. Da kommt bei solchen Fehlern ein Update vielleicht nächstes Jahr oder ...

 

[cibi]

1.2.23 und 1.4.9

Eine Woche später:

The Asterisk development team has released Asterisk versions 1.2.23 and
1.4.9.

These releases contain bug fixes, including one for a security vulnerability.
The vulnerability is a potential Denial of Service attack when the Asterisk
IAX2 channel driver is configured to allow unauthenticated calls.

Changelog 1.4.9

 

[Netview]

changelog 1.2.23:

2007-07-24  Jason Parker <[email protected]>

	* Asterisk 1.2.23 released

2007-07-24 16:32 +0000 [r76802]  Jason Parker <[email protected]>

	* channels/chan_iax2.c: Don't create the Asterisk channel until we
	  are starting the PBX on it. (ASA-2007-018)

2007-07-23 18:28 +0000 [r76560-76653]  Joshua Colp <[email protected]>

	* channels/chan_agent.c: (closes issue #5866) Reported by: tyler Do
	  not force channel format changes when a generator is present. The
	  generator may have changed the formats itself and changing them
	  back would cause issues.

	* channels/chan_sip.c: (closes issue #10236) Reported by: homesick
	  Patches: rpid_1.4_75840.patch uploaded by homesick (license 91)
	  Accept Remote Party ID on guest calls.

2007-07-22 21:39 +0000 [r76409]  Tilghman Lesher <[email protected]>

	* include/asterisk/app.h: We should not use C++ reserved words in
	  API headers (closes issue #10266)

2007-07-21 02:01 +0000 [r76226]  Russell Bryant <[email protected]>

	* channels/chan_sip.c: Backport a fix for a memory leak that was
	  fixed in trunk in reivision 76221 by rizzo. The memory used for
	  the localaddr list was not freed during a configuration reload.

2007-07-20 17:16 +0000 [r76080]  Joshua Colp <[email protected]>

	* channels/chan_sip.c: (closes issue #10247) Reported by:
	  fkasumovic Patches: chan_sip.patch uploaded by fkasumovic
	  (license #101) Drop any peer realm authentication entries when
	  reloading so multiple entries do not get added to the peer.

2007-07-19 15:49 +0000 [r75757-75927]  Russell Bryant <[email protected]>

	* channels/chan_iax2.c: When processing full frames, take sequence
	  number wraparound into account when deciding whether or not we
	  need to request retransmissions by sending a VNAK. This code
	  could cause VNAKs to be sent erroneously in some cases, and to
	  not be sent in other cases when it should have been. (closes
	  issue #10237, reported and patched by mihai)

	* channels/chan_iax2.c: When traversing the queue of frames for
	  possible retransmission after receiving a VNAK, handle sequence
	  number wraparound so that all frames that should be retransmitted
	  actually do get retransmitted. (issue #10227, reported and
	  patched by mihai)

2007-07-18 20:31 +0000 [r75748]  Tilghman Lesher <[email protected]>

	* apps/app_voicemail.c: Store prior to copy (closes issue #10193)

2007-07-18 17:48 +0000 [r75657]  Dwayne M. Hubbard <[email protected]>

	* apps/app_queue.c: removed the word 'pissed' from ast_log(...)
	  function call for BE-90

Asterisk Project Security Advisory -
Product Asterisk
Summary Resource Exhaustion vulnerability in IAX2 channel driver
Nature of Advisory Denial of Service
Susceptibility Remote Unauthenticated Sessions
Severity Moderate
Exploits Known No
Reported On July 19, 2007
Reported By Russell Bryant, Digium, Inc. <[email protected]>
Posted On July 23, 2007
Last Updated On July 23, 2007
Advisory Contact Russell Bryant <[email protected]>
CVE Name
Description The IAX2 channel driver in Asterisk is vulnerable to a Denial of Service attack when
configured to allow unauthenticated calls. An attacker can send a flood of NEW packets for
valid extensions to the server to initiate calls as the unauthenticated user. This will cause
resources on the Asterisk system to get allocated that will never go away. Furthermore, the
IAX2 channel driver will be stuck trying to reschedule retransmissions for each of these fake
calls forever. This can very quickly bring down a system and the only way to recover is to
restart Asterisk.
Detailed Explanation:
Within the last few months, we made some changes to chan_iax2 to combat the abuse of
this module for traffic amplification attacks. Unfortunately, this has caused an unintended
side effect.
The summary of the change to combat traffic amplification is this. Once you start the PBX on
the Asterisk channel, it will begin receiving frames to be sent back out to the network. We
delayed this from happening until a 3-way handshake has occurred to help ensure that we
are talking to the IP address the messages appear to be coming from.
When chan_iax2 accepts an unauthenticated call, it immediately creates the ast_channel for
the call. However, since the 3-way handshake has not been completed, the PBX is not
started on this channel.
Later, when the maximum number of retries have been exceeded on responses to this NEW,
the code tries to hang up the call. Now, it has 2 ways to do this, depending on if there is an
ast_channel related to this IAX2 session or not. If there is no channel, then it can just destroy
the iax2 private structure and move on. If there is a channel, it queues a HANGUP frame, and
expects that to make the ast_channel get torn down, which would then cause the pvt struct
to get destroyed afterwords.
Asterisk Project Security Advisory -
Copyright © 2007 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its original, unaltered form.
Asterisk Project Security Advisory -
However, since there was no PBX started on this channel, there is nothing servicing the
channel to receive the HANGUP frame. Therefore, the call never gets destroyed. To make
things worse, there is some code continuously rescheduling PINGs and LAGRQs to be sent for
the active IAX2 call, which will always fail.
In summary, sending a bunch of NEW frames to request unauthenticated calls can make a
server unusable within a matter of seconds.
Resolution The default configuration that is distributed with Asterisk includes a guest account that
allows unauthenticated calls. If this account and any other account without a password is
disabled for IAX2, then the system is not vulnerable to this problem.
For systems that continue to allow unauthenticated IAX2 calls, they must be updated to one
of the versions listed as including the fix below.
Affected Versions
Product Release
Series
Asterisk Open Source 1.0.x Not affected
Asterisk Open Source 1.2.x 1.2.20, 1.2.21, 1.2.21.1, 1.2.22
Asterisk Open Source 1.4.x 1.4.5, 1.4.6, 1.4.7, 1.4.7.1, 1.4.8
Asterisk Business Edition A.x.x Not affected
Asterisk Business Edition B.x.x Not affected
AsteriskNOW pre-release beta6
Asterisk Appliance Developer Kit 0.x.x 0.5.0
s800i (Asterisk Appliance) 1.0.x 1.0.0-beta5 up to and including 1.0.2
Corrected In
Product Release
Asterisk Open Source 1.2.23 and 1.4.9, available for download from
http://ftp.digium.com/pub/asterisk
AsteriskNOW Beta6, available from http://www.asterisknow.org/. Users
can update using the system update feature in the
appliance control panel.
Asterisk Appliance Developer Kit 0.6.0, available for download from
http://ftp.digium.com/pub/aadk
s800i (Asterisk Appliance) 1.0.3
Asterisk Project Security Advisory -
Copyright © 2007 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its original, unaltered form.
Asterisk Project Security Advisory -
Links
Asterisk Project Security Advisories are posted at http://www.asterisk.org/security.
This document may be superseded by later versions; if so, the latest version will be posted at
http://ftp.digium.com/pub/asa/.pdf.
Revision History
Date Editor Revisions Made
July 23, 2007 [email protected] Initial Release
Asterisk Project Security Advisory -
Copyright © 2007 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its original, unaltered form.