kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Document asterisk vulnerabilities.

Browse source
This commit is contained in:
Guido Falsi 2016-09-08 20:52:39 +00:00
parent 28a31a5ef3
commit ae104413b1
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=421580
1 changed files with 75 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

75
security/vuxml/vuln.xml
View file

@ -58,6 +58,81 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="5cb18881-7604-11e6-b362-001999f8d30b">
<topic>asterisk -- RTP Resource Exhaustion</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.23.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>The overlap dialing feature in chan_sip allows chan_sip
to report to a device that the number that has been dialed
is incomplete and more digits are required. If this
functionality is used with a device that has performed
username/password authentication RTP resources are leaked.
This occurs because the code fails to release the old RTP
resources before allocating new ones in this scenario.
If all resources are used then RTP port exhaustion will
occur and no RTP sessions are able to be set up.</p>
<p>If overlap dialing support is not needed the "allowoverlap"
option can be set to no. This will stop any usage of the
scenario which causes the resource exhaustion.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-007.html</url>
</references>
<dates>
<discovery>2016-08-05</discovery>
<entry>2016-09-08</entry>
</dates>
</vuln>
<vuln vid="7fda7920-7603-11e6-b362-001999f8d30b">
<topic>asterisk -- Crash on ACK from unknown endpoint</topic>
<affects>
<package>
<name>asterisk13</name>
<range><ge>13.10.0</ge><lt>13.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>Asterisk can be crashed remotely by sending an ACK to
it from an endpoint username that Asterisk does not
recognize. Most SIP request types result in an "artificial"
endpoint being looked up, but ACKs bypass this lookup.
The resulting NULL pointer results in a crash when
attempting to determine if ACLs should be applied.</p>
<p>This issue was introduced in the Asterisk 13.10 release
and only affects that release.</p>
<p>This issue only affects users using the PJSIP stack
with Asterisk. Those users that use chan_sip are
unaffected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-006.html</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-09-08</entry>
</dates>
</vuln>
<vuln vid="70c85c93-743c-11e6-a590-14dae9d210b8">
<topic>inspircd -- authentication bypass vulnerability</topic>
<affects>