kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Document vulnerabilities in asterisk ports.

Browse source
This commit is contained in:
Guido Falsi 2017-09-01 07:32:36 +00:00
parent e75fa8b41e
commit 6512c6b856
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=449056
1 changed files with 72 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

72
security/vuxml/vuln.xml
View file

@ -58,6 +58,78 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="ec1df2a1-8ee6-11e7-8be8-001999f8d30b">
<topic>asterisk -- Remote Crash Vulerability in res_pjsip</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>A carefully crafted URI in a From, To or Contact header could cause Asterisk to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-007.html</url>
<cvename>CVE-2017-14098</cvename>
</references>
<dates>
<discovery>2017-08-31</discovery>
<entry>2017-09-01</entry>
</dates>
</vuln>
<vuln vid="c599f95c-8ee5-11e7-8be8-001999f8d30b">
<topic>asterisk -- Unauthorized data disclosure and shell access command injection in app_minivm</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.25.2</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>AST-2017-005 - A change was made to the strict RTP
support in the RTP stack to better tolerate late media
when a reinvite occurs. When combined with the symmetric
RTP support this introduced an avenue where media could
be hijacked. Instead of only learning a new address when
expected the new code allowed a new source address to be
learned at all times.</p>
<p>AST-2017-006 - The app_minivm module has an "externnotify"
program configuration option that is executed by the
MinivmNotify dialplan application. The application uses
the caller-id name and number as part of a built string
passed to the OS shell for interpretation and execution.
Since the caller-id name and number can come from an
untrusted source, a crafted caller-id name or number
allows an arbitrary shell command injection.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-005.html</url>
<cvename>CVE-2017-14099</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2017-006.html</url>
<cvename>CVE-2017-14100</cvename>
</references>
<dates>
<discovery>2017-08-31</discovery>
<entry>2017-09-01</entry>
</dates>
</vuln>
<vuln vid="22f28bb3-8d98-11e7-8c37-e8e0b747a45a">
<topic>libgcrypt -- side-channel attack vulnerability</topic>
<affects>