ASTERWEB Blog

AST-2017-001: Buffer overflow in CDR’s set user

               Asterisk Project Security Advisory - AST-2017-001

         Product        Asterisk                                              
         Summary        Buffer overflow in CDR's set user                     
    Nature of Advisory  Buffer Overflow                                       
      Susceptibility    Remote Authenticated Sessions                         
         Severity       Moderate                                              
      Exploits Known    No                                                    
       Reported On      March 27, 2017                                        
       Reported By      Alex Villacis Lasso                                   
        Posted On       
     Last Updated On    April 4, 2017                                         
     Advisory Contact   kharwell AT digium DOT com                            
         CVE Name       

    Description  No size checking is done when setting the user field on a    
                 CDR. Thus, it is possible for someone to use an arbitrarily  
                 large string and write past the end of the user field        
                 storage buffer. This allows the possibility of remote code   
                 injection.                                                   
                                                                              
                 This currently affects any system using CDR's that also      
                 make use of the following:                                   
                                                                              
                 * The 'X-ClientCode' header within a SIP INFO message when   
                 using chan_sip and                                           
                                                                              
                 the 'useclientcode' option is enabled (note, it's disabled   
                 by default).                                                 
                                                                              
                 * The CDR dialplan function executed from AMI when setting   
                 the user field.                                              
                                                                              
                 * The AMI Monitor action when using a long file name/path.   

    Resolution  The CDR engine now only copies up to the maximum allowed      
                characters into the user field. Any characters outside the    
                maximum are truncated.                                        

                               Affected Versions       
                         Product                       Release  
                                                       Series   
                  Asterisk Open Source                  13.x    All Releases  
                  Asterisk Open Source                  14.x    All Releases  
                   Certified Asterisk                   13.13   All Releases  

                                  Corrected In                
                            Product                              Release      
                      Asterisk Open Source                    13.14.1,14.3.1  
                       Certified Asterisk                      13.13-cert3    

                                     Patches                          
                                SVN URL                               Revision  
   http://downloads.asterisk.org/pub/security/AST-2017-001-13.diff    Asterisk  
                                                                      13        
   http://downloads.asterisk.org/pub/security/AST-2017-001-14.diff    Asterisk  
                                                                      14        
   http://downloads.asterisk.org/pub/security/AST-2017-001-13.13.diff Certified 
                                                                      Asterisk  
                                                                      13.13     

    Links  https://issues.asterisk.org/jira/browse/ASTERISK-26897             

    Asterisk Project Security Advisories are posted at                        
    http://www.asterisk.org/security                                          
                                                                              
    This document may be superseded by later versions; if so, the latest      
    version will be posted at                                                 
    http://downloads.digium.com/pub/security/AST-2017-001.pdf and             
    http://downloads.digium.com/pub/security/AST-2017-001.html                

                                Revision History
         Date           Editor                   Revisions Made               
    March, 27, 2017  Kevin Harwell  Initial Revision                          

               Asterisk Project Security Advisory - AST-2017-001
               Copyright © 2017 Digium, Inc. All Rights Reserved.
  Permission is hereby granted to distribute and publish this advisory in its
                           original, unaltered form.

AST-2016-009: Remote unauthenticated sessions in chan_sip

Dal Team Asterisk Security (8 dicembre 2016).

Dal post originale:

             Asterisk Project Security Advisory - ASTERISK-2016-009

         Product        Asterisk

         Summary

    Nature of Advisory  Authentication Bypass

      Susceptibility    Remote unauthenticated sessions

         Severity       Minor

      Exploits Known    No

       Reported On      October 3, 2016

       Reported By      Walter Doekes

        Posted On

     Last Updated On    December 8, 2016

     Advisory Contact   Mmichelson AT digium DOT com

         CVE Name       
    Description  The chan_sip channel driver has a liberal definition for

                 whitespace when attempting to strip the content between a

                 SIP header name and a colon character. Rather than

                 following RFC 3261 and stripping only spaces and horizontal

                 tabs, Asterisk treats any non-printable ASCII character as

                 if it were whitespace. This means that headers such as       
                 Contact\x01:                                                 
                 will be seen as a valid Contact header.                      
                 This mostly does not pose a problem until Asterisk is

                 placed in tandem with an authenticating SIP proxy. In such

                 a case, a crafty combination of valid and invalid To

                 headers can cause a proxy to allow an INVITE request into

                 Asterisk without authentication since it believes the

                 request is an in-dialog request. However, because of the

                 bug described above, the request will look like an

                 out-of-dialog request to Asterisk. Asterisk will then

                 process the request as a new call. The result is that

                 Asterisk can process calls from unvetted sources without

                 any authentication.                                          
                 If you do not use a proxy for authentication, then this

                 issue does not affect you.                                   
                 If your proxy is dialog-aware (meaning that the proxy keeps

                 track of what dialogs are currently valid), then this issue

                 does not affect you.                                         
                 If you use chan_pjsip instead of chan_sip, then this issue

                 does not affect you.                                         
    Resolution  chan_sip has been patched to only treat spaces and

                horizontal tabs as whitespace following a header name. This

                allows for Asterisk and authenticating proxies to view

                requests the same way                                         
                               Affected Versions

                         Product                       Release

                                                       Series

                  Asterisk Open Source                  11.x    All Releases

                  Asterisk Open Source                  13.x    All Releases

                  Asterisk Open Source                  14.x    All Releases

                   Certified Asterisk                   13.8    All Releases  
                                  Corrected In

          Product                              Release

    Asterisk Open Source               11.25.1, 13.13.1, 14.2.1

     Certified Asterisk                11.6-cert16, 13.8-cert4                
                                    Patches

                 SVN URL                              Revision                
           Links         
    Asterisk Project Security Advisories are posted at

    http://www.asterisk.org/security                                          
    This document may be superseded by later versions; if so, the latest

    version will be posted at

    http://downloads.digium.com/pub/security/ASTERISK-2016-009.pdf and

    http://downloads.digium.com/pub/security/ASTERISK-2016-009.html           
                                Revision History

                     Date                        Editor      Revisions Made

    November 28, 2016                        Mark Michelson  Initial writeup  
             Asterisk Project Security Advisory - ASTERISK-2016-009

              Copyright (c) 2016 Digium, Inc. All Rights Reserved.

  Permission is hereby granted to distribute and publish this advisory in its

                           original, unaltered form.

AST-2016-008: Crash on SDP offer or answer from endpoint using Opus

Dal Team Asterisk Security (8 dicembre 2016).

Dal post originale:

               Asterisk Project Security Advisory - AST-2016-008

         Product        Asterisk

         Summary        Crash on SDP offer or answer from endpoint using

                        Opus

    Nature of Advisory  Remote Crash

      Susceptibility    Remote unauthenticated sessions

         Severity       Critical

      Exploits Known    No

       Reported On      November 11, 2016

       Reported By      jorgen

        Posted On

     Last Updated On    November 15, 2016

     Advisory Contact   jcolp AT digium DOT com

         CVE Name       
    Description  If an SDP offer or answer is received with the Opus codec

                 and with the format parameters separated using a space the

                 code responsible for parsing will recursively call itself

                 until it crashes. This occurs as the code does not properly

                 handle spaces separating the parameters. This does NOT

                 require the endpoint to have Opus configured in Asterisk.

                 This also does not require the endpoint to be

                 authenticated. If guest is enabled for chan_sip or

                 anonymous in chan_pjsip an SDP offer or answer is still

                 processed and the crash occurs.                              
    Resolution  The code has been updated to properly handle spaces

                separating parameters in the fmtp line. Upgrade to a

                released version with the fix incorporated or apply patch.    
                               Affected Versions

                      Product                    Release

                                                 Series

               Asterisk Open Source               13.x    13.12.0 and higher

               Asterisk Open Source               14.x    All Versions        
                                  Corrected In

                            Product                              Release

                     Asterisk Open Source                    13.13.1, 14.2.1  
                                    Patches

                                SVN URL                              Revision

   http://downloads.asterisk.org/pub/security/AST-2016-008-13.diff   Asterisk

                                                                     13

   http://downloads.asterisk.org/pub/security/AST-2016-008-14.diff   Asterisk

                                                                     14       
    Links  https://issues.asterisk.org/jira/browse/ASTERISK-26579             
    Asterisk Project Security Advisories are posted at

    http://www.asterisk.org/security                                          
    This document may be superseded by later versions; if so, the latest

    version will be posted at

    http://downloads.digium.com/pub/security/AST-2016-008.pdf and

    http://downloads.digium.com/pub/security/AST-2016-008.html                
                                Revision History

          Date           Editor                  Revisions Made

    November 15, 2016  Joshua Colp  Initial draft of Advisory                 
               Asterisk Project Security Advisory - AST-2016-008

               Copyright © 2016 Digium, Inc. All Rights Reserved.

  Permission is hereby granted to distribute and publish this advisory in its

                           original, unaltered form.