Rilasciato Asterisk 11.15.0
Il giorno 15 dicembre 2014, il Team di Sviluppo di Asterisk ha annunciato il rilascio di Asterisk 12.8.0.
Dal post originale:
The Asterisk Development Team has announced the release of Asterisk 11.15.0.
This release is available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk
The release of Asterisk 11.15.0 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!
The following are the issues resolved in this release:
Bugs fixed in this release:
-----------------------------------
* ASTERISK-20127 - [Regression] Config.c config_text_file_load()
unescapes semicolons ("\;" -> ";") turning them into comments
(corruption) on rewrite of a config file (Reported by George
Joseph)
* ASTERISK-24307 - Unintentional memory retention in stringfields
(Reported by Etienne Lessard)
* ASTERISK-24492 - main/file.c: ast_filestream sometimes causes
extra calls to ast_module_unref (Reported by Corey Farrell)
* ASTERISK-24504 - chan_console: Fix reference leaks to pvt
(Reported by Corey Farrell)
* ASTERISK-24468 - Incoming UCS2 encoded SMS truncated if SMS
length exceeds 50 (roughly) national symbols (Reported by
Dmitriy Bubnov)
* ASTERISK-24500 - Regression introduced in chan_mgcp by SVN
revision r227276 (Reported by Xavier Hienne)
* ASTERISK-20402 - Unable to cancel (features.conf) attended
transfer (Reported by Matt Riddell)
* ASTERISK-24505 - manager: http connections leak references
(Reported by Corey Farrell)
* ASTERISK-24502 - Build fails when dev-mode, dont optimize and
coverage are enabled (Reported by Corey Farrell)
* ASTERISK-24444 - PBX: Crash when generating extension for
pattern matching hint (Reported by Leandro Dardini)
* ASTERISK-24522 - ConfBridge: delay occurs between kicking all
endmarked users when last marked user leaves (Reported by Matt
Jordan)
* ASTERISK-15242 - transmit_refer leaks sip_refer structures
(Reported by David Woolley)
* ASTERISK-24440 - Call leak in Confbridge (Reported by Ben Klang)
* ASTERISK-24469 - Security Vulnerability: Mixed IPv4/IPv6 ACLs
allow blocked addresses through (Reported by Matt Jordan)
* ASTERISK-24516 - [patch]Asterisk segfaults when playing back
voicemail under high concurrency with an IMAP backend (Reported
by David Duncan Ross Palmer)
* ASTERISK-24572 - [patch]App_meetme is loaded without its
defaults when the configuration file is missing (Reported by
Nuno Borges)
* ASTERISK-24573 - [patch]Out of sync conversation recording when
divided in multiple recordings (Reported by Nuno Borges)
Improvements made in this release:
-----------------------------------
* ASTERISK-24283 - [patch]Microseconds precision in the eventtime
column in the cel_odbc module (Reported by Etienne Lessard)
* ASTERISK-24530 - [patch] app_record stripping 1/4 second from
recordings (Reported by Ben Smithurst)
* ASTERISK-24577 - Speed up loopback switches by avoiding unneeded
lookups (Reported by Birger "WIMPy" Harzenetter)
For a full list of changes in this release, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-11.15.0
Rilasciato Asterisk 12.8.0
Il giorno 15 dicembre 2014, il Team di Sviluppo di Asterisk ha annunciato il rilascio di Asterisk 12.8.0.
Dal post originale:
The Asterisk Development Team has announced the release of Asterisk 12.8.0.
This release is available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk
The release of Asterisk 12.8.0 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!
The following are the issues resolved in this release:
Bugs fixed in this release:
-----------------------------------
* ASTERISK-24480 - res_http_websockets: Module reference decrease
below zero (Reported by Corey Farrell)
* ASTERISK-24482 - func_talkdetect: Fix stasis message leak in
audiohook callback (Reported by Corey Farrell)
* ASTERISK-24487 - configuration: sections should be loadable as
template even when not marked (Reported by Scott Griepentrog)
* ASTERISK-20127 - [Regression] Config.c config_text_file_load()
unescapes semicolons ("\;" -> ";") turning them into comments
(corruption) on rewrite of a config file (Reported by George
Joseph)
* ASTERISK-24438 - res_pjsip_multihomed.so blocks Asterisk reload
when DNS settings invalid (Reported by Melissa Shepherd)
* ASTERISK-24307 - Unintentional memory retention in stringfields
(Reported by Etienne Lessard)
* ASTERISK-24491 - Memory leak in res_hep (Reported by Zane
Conkle)
* ASTERISK-24492 - main/file.c: ast_filestream sometimes causes
extra calls to ast_module_unref (Reported by Corey Farrell)
* ASTERISK-24447 - Bridge DTMF hooks: Audio doesn't pass when
waiting for more matching digits. (Reported by Richard Mudgett)
* ASTERISK-24257 - agent must dial acceptdtmf twice to bridge to
queue caller (Reported by Steve Pitts)
* ASTERISK-24504 - chan_console: Fix reference leaks to pvt
(Reported by Corey Farrell)
* ASTERISK-24468 - Incoming UCS2 encoded SMS truncated if SMS
length exceeds 50 (roughly) national symbols (Reported by
Dmitriy Bubnov)
* ASTERISK-24500 - Regression introduced in chan_mgcp by SVN
revision r227276 (Reported by Xavier Hienne)
* ASTERISK-24505 - manager: http connections leak references
(Reported by Corey Farrell)
* ASTERISK-24502 - Build fails when dev-mode, dont optimize and
coverage are enabled (Reported by Corey Farrell)
* ASTERISK-24444 - PBX: Crash when generating extension for
pattern matching hint (Reported by Leandro Dardini)
* ASTERISK-24489 - Crash: Asterisk crashes when converting RTCP
packet to JSON for res_hep_rtcp and report blocks are greater
than 1 (Reported by Gregory Malsack)
* ASTERISK-24498 - Segmentation fault in res_hep_rtcp on attended
transfer (Reported by Beppo Mazzucato)
* ASTERISK-24501 - ARI: Moving a channel between bridges followed
by a hangup can cause an ARI client to not receive an expected
ChannelLeftBridge event before StasisEnd (Reported by Matt
Jordan)
* ASTERISK-24336 - PJSIP timer_min_se value under 90 causes crash
(Reported by Leon Rowland)
* ASTERISK-23651 - Reloading some modules that are loaded already,
results in 'No such module' before a successful reload (Reported
by Rusty Newton)
* ASTERISK-24522 - ConfBridge: delay occurs between kicking all
endmarked users when last marked user leaves (Reported by Matt
Jordan)
* ASTERISK-15242 - transmit_refer leaks sip_refer structures
(Reported by David Woolley)
* ASTERISK-24508 - pjsip - REFER request from SNOM is rejected
with "400 bad request" - DEBUG shows "Received a REFER without a
parseable Refer-To" (Reported by Beppo Mazzucato)
* ASTERISK-24535 - stringfields: Fix regression from fix for
unintentional memory retention and another issue exposed by the
fix (Reported by Corey Farrell)
* ASTERISK-24471 - Crash - assert_fail in libc in
pjmedia_sdp_neg_negotiate from /usr/local/lib/libpjmedia.so.2
(Reported by yaron nahum)
* ASTERISK-24528 - res_pjsip_refer: Sending INVITE with Replaces
in-dialog with invalid target causes crash (Reported by Joshua
Colp)
* ASTERISK-24531 - res_pjsip_acl: ACLs not applied on initial
module load (Reported by Matt Jordan)
* ASTERISK-24469 - Security Vulnerability: Mixed IPv4/IPv6 ACLs
allow blocked addresses through (Reported by Matt Jordan)
* ASTERISK-24533 - 2 threads created per chan_sip entry (Reported
by xrobau)
* ASTERISK-24516 - [patch]Asterisk segfaults when playing back
voicemail under high concurrency with an IMAP backend (Reported
by David Duncan Ross Palmer)
* ASTERISK-24572 - [patch]App_meetme is loaded without its
defaults when the configuration file is missing (Reported by
Nuno Borges)
* ASTERISK-24573 - [patch]Out of sync conversation recording when
divided in multiple recordings (Reported by Nuno Borges)
* ASTERISK-24537 - Stasis: StasisStart/StasisEnd events are not
reliably transmitted during transfers (Reported by Matt Jordan)
Improvements made in this release:
-----------------------------------
* ASTERISK-24279 - Documentation: Clarify the behaviour of the CDR
property 'unanswered' (Reported by Matt Jordan)
* ASTERISK-24283 - [patch]Microseconds precision in the eventtime
column in the cel_odbc module (Reported by Etienne Lessard)
* ASTERISK-24530 - [patch] app_record stripping 1/4 second from
recordings (Reported by Ben Smithurst)
* ASTERISK-24577 - Speed up loopback switches by avoiding unneeded
lookups (Reported by Birger "WIMPy" Harzenetter)
For a full list of changes in this release, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-12.8.0
Rilasciato Asterisk 13.1.0
Il giorno 15 dicembre 2014, il Team di Sviluppo di Asterisk ha annunciato il rilascio di Asterisk 13.1.0.
Dal post originale:
he Asterisk Development Team has announced the release of Asterisk 13.1.0.
This release is available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk
The release of Asterisk 13.1.0 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!
The following are the issues resolved in this release:
New Features made in this release:
-----------------------------------
* ASTERISK-24554 - AMI/ARI: Generate events on connected line
changes (Reported by Matt Jordan)
Bugs fixed in this release:
-----------------------------------
* ASTERISK-24436 - Missing header in res/res_srtp.c when compiling
against libsrtp-1.5.0 (Reported by Patrick Laimbock)
* ASTERISK-24455 - func_cdr: CDR_PROP leaks payload (Reported by
Corey Farrell)
* ASTERISK-24454 - app_queue: ao2_iterator not destroyed, causing
leak (Reported by Corey Farrell)
* ASTERISK-24430 - missing letter "p" in word response in
OriginateResponse event documentation (Reported by Dafi Ni)
* ASTERISK-24437 - Review implementation of ast_bridge_impart for
leaks and document proper usage (Reported by Scott Griepentrog)
* ASTERISK-24453 - manager: acl_change_sub leaks (Reported by
Corey Farrell)
* ASTERISK-24457 - res_fax: fax gateway frames leak (Reported by
Corey Farrell)
* ASTERISK-24458 - chan_phone fails to build on big endian systems
(Reported by Tzafrir Cohen)
* ASTERISK-21721 - SIP Failed to parse multiple Supported: headers
(Reported by Olle Johansson)
* ASTERISK-24304 - asterisk crashing randomly because of unistim
channel (Reported by dhanapathy sathya)
* ASTERISK-24190 - IMAP voicemail causes segfault (Reported by
Nick Adams)
* ASTERISK-24462 - res_pjsip: Stale qualify statistics after
disablementation (Reported by Kevin Harwell)
* ASTERISK-24465 - audiohooks list leaks reference to formats
(Reported by Corey Farrell)
* ASTERISK-24466 - app_queue: fix a couple leaks to struct
call_queue (Reported by Corey Farrell)
* ASTERISK-24432 - Install refcounter.py when REF_DEBUG is enabled
(Reported by Corey Farrell)
* ASTERISK-24411 - [patch] Status of outbound registration is not
changed upon unregistering. (Reported by John Bigelow)
* ASTERISK-24476 - main/app.c / app_voicemail: ast_writestream
leaks (Reported by Corey Farrell)
* ASTERISK-24480 - res_http_websockets: Module reference decrease
below zero (Reported by Corey Farrell)
* ASTERISK-24482 - func_talkdetect: Fix stasis message leak in
audiohook callback (Reported by Corey Farrell)
* ASTERISK-24487 - configuration: sections should be loadable as
template even when not marked (Reported by Scott Griepentrog)
* ASTERISK-20127 - [Regression] Config.c config_text_file_load()
unescapes semicolons ("\;" -> ";") turning them into comments
(corruption) on rewrite of a config file (Reported by George
Joseph)
* ASTERISK-24438 - res_pjsip_multihomed.so blocks Asterisk reload
when DNS settings invalid (Reported by Melissa Shepherd)
* ASTERISK-24307 - Unintentional memory retention in stringfields
(Reported by Etienne Lessard)
* ASTERISK-24491 - Memory leak in res_hep (Reported by Zane
Conkle)
* ASTERISK-24492 - main/file.c: ast_filestream sometimes causes
extra calls to ast_module_unref (Reported by Corey Farrell)
* ASTERISK-24447 - Bridge DTMF hooks: Audio doesn't pass when
waiting for more matching digits. (Reported by Richard Mudgett)
* ASTERISK-24257 - agent must dial acceptdtmf twice to bridge to
queue caller (Reported by Steve Pitts)
* ASTERISK-24504 - chan_console: Fix reference leaks to pvt
(Reported by Corey Farrell)
* ASTERISK-24250 - [patch] Voicemail with multi-recipients To:
header fix (Reported by abelbeck)
* ASTERISK-24468 - Incoming UCS2 encoded SMS truncated if SMS
length exceeds 50 (roughly) national symbols (Reported by
Dmitriy Bubnov)
* ASTERISK-24500 - Regression introduced in chan_mgcp by SVN
revision r227276 (Reported by Xavier Hienne)
* ASTERISK-24505 - manager: http connections leak references
(Reported by Corey Farrell)
* ASTERISK-24502 - Build fails when dev-mode, dont optimize and
coverage are enabled (Reported by Corey Farrell)
* ASTERISK-24444 - PBX: Crash when generating extension for
pattern matching hint (Reported by Leandro Dardini)
* ASTERISK-24489 - Crash: Asterisk crashes when converting RTCP
packet to JSON for res_hep_rtcp and report blocks are greater
than 1 (Reported by Gregory Malsack)
* ASTERISK-24498 - Segmentation fault in res_hep_rtcp on attended
transfer (Reported by Beppo Mazzucato)
* ASTERISK-24501 - ARI: Moving a channel between bridges followed
by a hangup can cause an ARI client to not receive an expected
ChannelLeftBridge event before StasisEnd (Reported by Matt
Jordan)
* ASTERISK-24336 - PJSIP timer_min_se value under 90 causes crash
(Reported by Leon Rowland)
* ASTERISK-23651 - Reloading some modules that are loaded already,
results in 'No such module' before a successful reload (Reported
by Rusty Newton)
* ASTERISK-24522 - ConfBridge: delay occurs between kicking all
endmarked users when last marked user leaves (Reported by Matt
Jordan)
* ASTERISK-15242 - transmit_refer leaks sip_refer structures
(Reported by David Woolley)
* ASTERISK-24508 - pjsip - REFER request from SNOM is rejected
with "400 bad request" - DEBUG shows "Received a REFER without a
parseable Refer-To" (Reported by Beppo Mazzucato)
* ASTERISK-24535 - stringfields: Fix regression from fix for
unintentional memory retention and another issue exposed by the
fix (Reported by Corey Farrell)
* ASTERISK-24471 - Crash - assert_fail in libc in
pjmedia_sdp_neg_negotiate from /usr/local/lib/libpjmedia.so.2
(Reported by yaron nahum)
* ASTERISK-24528 - res_pjsip_refer: Sending INVITE with Replaces
in-dialog with invalid target causes crash (Reported by Joshua
Colp)
* ASTERISK-24531 - res_pjsip_acl: ACLs not applied on initial
module load (Reported by Matt Jordan)
* ASTERISK-24469 - Security Vulnerability: Mixed IPv4/IPv6 ACLs
allow blocked addresses through (Reported by Matt Jordan)
* ASTERISK-24542 - [patch]Failure showing codecs via 'core show
channeltype
* ASTERISK-24533 - 2 threads created per chan_sip entry (Reported
by xrobau)
* ASTERISK-24516 - [patch]Asterisk segfaults when playing back
voicemail under high concurrency with an IMAP backend (Reported
by David Duncan Ross Palmer)
* ASTERISK-24572 - [patch]App_meetme is loaded without its
defaults when the configuration file is missing (Reported by
Nuno Borges)
* ASTERISK-24573 - [patch]Out of sync conversation recording when
divided in multiple recordings (Reported by Nuno Borges)
* ASTERISK-24537 - Stasis: StasisStart/StasisEnd events are not
reliably transmitted during transfers (Reported by Matt Jordan)
* ASTERISK-24556 - Asterisk 13 core dumps when calling from pjsip
extension to another pjsip extension (Reported by Abhay Gupta)
Improvements made in this release:
-----------------------------------
* ASTERISK-24279 - Documentation: Clarify the behaviour of the CDR
property 'unanswered' (Reported by Matt Jordan)
* ASTERISK-24283 - [patch]Microseconds precision in the eventtime
column in the cel_odbc module (Reported by Etienne Lessard)
* ASTERISK-24530 - [patch] app_record stripping 1/4 second from
recordings (Reported by Ben Smithurst)
* ASTERISK-24577 - Speed up loopback switches by avoiding unneeded
lookups (Reported by Birger "WIMPy" Harzenetter)
For a full list of changes in this release, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-13.1.0
AST-2014-019: Remote Crash Vulnerability in WebSocket Server
Il giorno 10 dicembre 2014, il Team di Sviluppo di Asterisk ha annunciato il rilascio di AST-2014-019: Remote Crash Vulnerability in WebSocket Server.
Dal post originale:
sterisk Project Security Advisory - AST-2014-019
Product Asterisk
Summary Remote Crash Vulnerability in WebSocket Server
Nature of Advisory Denial of Service
Susceptibility Remote Unauthenticated Sessions
Severity Moderate
Exploits Known No
Reported On 30 October 2014
Reported By Badalian Vyacheslav
Posted On 10 December 2014
Last Updated On December 10, 2014
Advisory Contact Joshua Colp
CVE Name
Description When handling a WebSocket frame the res_http_websocket
module dynamically changes the size of the memory used to
allow the provided payload to fit. If a payload length of
zero was received the code would incorrectly attempt to
resize to zero. This operation would succeed and end up
freeing the memory but be treated as a failure. When the
session was subsequently torn down this memory would get
freed yet again causing a crash.
Users of the WebSocket functionality also did not take into
account that provided text frames are not guaranteed to be
NULL terminated. This has been fixed in chan_sip and
chan_pjsip in the applicable versions.
Resolution Ensure the built-in HTTP server is disabled, upgrade to a
version listed below, or apply the applicable patch.
The change ensures that res_http_websocket does not treat
the freeing of memory when a payload length of zero is
received as fatal.
Affected Versions
Product Release
Series
Certified Asterisk 11.6 All versions
Asterisk Open Source 11.x All versions
Asterisk Open Source 12.x All versions
Asterisk Open Source 13.x All versions
Corrected In
Product Release
Certified Asterisk 11.6-cert9
Asterisk Open Source 11.14.2, 12.7.2, 13.0.2
Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2014-019-11.6.diff Certified
Asterisk
11.6
http://downloads.asterisk.org/pub/security/AST-2014-019-11.diff Asterisk
11
http://downloads.asterisk.org/pub/security/AST-2014-019-12.diff Asterisk
12
http://downloads.asterisk.org/pub/security/AST-2014-019-13.diff Asterisk
13
Links https://issues.asterisk.org/jira/browse/ASTERISK-24472
Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security
This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2014-019.pdf and
http://downloads.digium.com/pub/security/AST-2014-019.html