kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Upgrade to Asterisk 10.11.1; this is a security fix to fix AST-2012-14

Browse source 
and AST-2012-015.

Approved for commit during freeze by: agc

The Asterisk Development Team has announced security releases for Certified
Asterisk 1.8.11 and Asterisk 1.8, 10, and 11. The available security releases
are released as versions 1.8.11-cert10, 1.8.19.1, 10.11.1, 10.11.1-digiumphones,
and 11.1.1.

The release of these versions resolve the following two issues:

* Stack overflows that occur in some portions of Asterisk that manage a TCP
  connection. In SIP, this is exploitable via a remote unauthenticated session;
  in XMPP and HTTP connections, this is exploitable via remote authenticated
  sessions.

* A denial of service vulnerability through exploitation of the device state
  cache. Anonymous calls had the capability to create devices in Asterisk that
  would never be disposed of.

These issues and their resolutions are described in the security advisories.

For more information about the details of these vulnerabilities, please read
security advisories AST-2012-014 and AST-2012-015, which were released at the
same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLogs:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.1.1

The security advisories are available at:

 * http://downloads.asterisk.org/pub/security/AST-2012-014.pdf
 * http://downloads.asterisk.org/pub/security/AST-2012-015.pdf

Thank you for your continued support of Asterisk!
This commit is contained in:
jnemeth 2013-01-03 02:14:28 +00:00
parent 7ee16d1e3c
commit fbda522e8a
2 changed files with 9 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
comms/asterisk10/Makefile
View file

@ -1,13 +1,12 @@
# $NetBSD: Makefile,v 1.37 2012/12/16 01:52:01 obache Exp $
# $NetBSD: Makefile,v 1.38 2013/01/03 02:14:28 jnemeth Exp $
#
# NOTE: when updating this package, there are two places that sound
# tarballs need to be checked
DISTNAME= asterisk-10.11.0
DISTNAME= asterisk-10.11.1
DIST_SUBDIR= ${PKGNAME_NOREV}
DISTFILES= ${DEFAULT_DISTFILES}
EXTRACT_ONLY= ${DISTNAME}.tar.gz
PKGREVISION= 1
CATEGORIES= comms net audio
MASTER_SITES= http://downloads.asterisk.org/pub/telephony/asterisk/ \
http://downloads.asterisk.org/pub/telephony/asterisk/old-releases/ \

14
comms/asterisk10/distinfo
View file

@ -1,11 +1,11 @@
$NetBSD: distinfo,v 1.23 2012/12/14 03:13:23 jnemeth Exp $
$NetBSD: distinfo,v 1.24 2013/01/03 02:14:28 jnemeth Exp $
SHA1 (asterisk-10.11.0/asterisk-10.11.0.tar.gz) = a678774bd6cb90fb4cefe115eb91a30228410288
RMD160 (asterisk-10.11.0/asterisk-10.11.0.tar.gz) = 233366c026d4d8806f04e6a43cf8d66a752eb359
Size (asterisk-10.11.0/asterisk-10.11.0.tar.gz) = 25095528 bytes
SHA1 (asterisk-10.11.0/asterisk-extra-sounds-en-gsm-1.4.11.tar.gz) = 8692fa61423b4769dc8bfa78faf9ed5ef7a259b9
RMD160 (asterisk-10.11.0/asterisk-extra-sounds-en-gsm-1.4.11.tar.gz) = 68170c769d739d6b5b35b00f999ad6bbf876f9f6
Size (asterisk-10.11.0/asterisk-extra-sounds-en-gsm-1.4.11.tar.gz) = 3349898 bytes
SHA1 (asterisk-10.11.1/asterisk-10.11.1.tar.gz) = b472ec3f5ce172c730dc9e066170ac2ef1673f84
RMD160 (asterisk-10.11.1/asterisk-10.11.1.tar.gz) = 107e89e19001968152594bae29242f369a5deb21
Size (asterisk-10.11.1/asterisk-10.11.1.tar.gz) = 25090000 bytes
SHA1 (asterisk-10.11.1/asterisk-extra-sounds-en-gsm-1.4.11.tar.gz) = 8692fa61423b4769dc8bfa78faf9ed5ef7a259b9
RMD160 (asterisk-10.11.1/asterisk-extra-sounds-en-gsm-1.4.11.tar.gz) = 68170c769d739d6b5b35b00f999ad6bbf876f9f6
Size (asterisk-10.11.1/asterisk-extra-sounds-en-gsm-1.4.11.tar.gz) = 3349898 bytes
SHA1 (patch-Makefile) = ab740f84f9883980cb5d8e8d5ca301f172c76231
SHA1 (patch-apps_app__dial.c) = e6c9f559310acdb6574d0e034dcb55df7c2ba31f
SHA1 (patch-apps_app__followme.c) = cd34774a11b96269003d9f1b6fbdfddf5d9b9d4b