[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 20 Jan 2012 10:55:20 -0500 (EST)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security@...ts.openwall.com
cc: "Steven M. Christey" <coley@...-smtp.mitre.org>,
Joshua Colp <jcolp@...ium.com>
Subject: Re: CVE Request -- Asterisk AST-2012-001 / Remote
DoS while processing crypto line for media stream with non-existing RTP
CVE-2012-0885 was already assigned to AST-2012-001 based on a request from
the upstream vendor. They probably updated their advisory since your
initial request:
http://downloads.asterisk.org/pub/security/AST-2012-001.html
- Steve
On Fri, 20 Jan 2012, Jan Lieskovsky wrote:
> Hello Kurt, Steve, vendors,
>
> a denial of service flaw was found in the way asterisk processed certain
> requests to negotiate secure video stream, when the res_srtp Asterisk module
> has been loaded and video support has not been enabled. A remote attacker
> could
> provide a specially-crafted media stream negotiation request, which once
> processed by Asterisk would lead to asterisk daemon crash by processing
> crypto
> line for such media stream.
>
> References:
> [1] http://downloads.asterisk.org/pub/security/AST-2012-001.html
> [2] https://issues.asterisk.org/jira/browse/ASTERISK-19202
> [3] https://bugzilla.redhat.com/show_bug.cgi?id=783487
>
> Upstream patch against the v1.8.x branch:
> [4] http://downloads.asterisk.org/pub/security/AST-2012-001-1.8.diff
>
> Upstream patch against the v1.10.x branch:
> [5] http://downloads.asterisk.org/pub/security/AST-2012-001-10.diff
>
> Could you allocate a CVE identifier for this?
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
