oss-security - Re: CVE Request -- Asterisk AST-2012-001 / Remote DoS while processing crypto line for media stream with non-existing RTP

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 20 Jan 2012 17:02:25 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>,
        Joshua Colp <jcolp@...ium.com>
Subject: Re: CVE Request -- Asterisk AST-2012-001 / Remote
 DoS while processing crypto line for media stream with non-existing RTP

On 01/20/2012 04:55 PM, Steven M. Christey wrote:
>
> CVE-2012-0885 was already assigned to AST-2012-001 based on a request from the upstream vendor. They
> probably updated their advisory since your initial request:
>
> http://downloads.asterisk.org/pub/security/AST-2012-001.html

Thanks for your prompt reply, Steve. It has been truly updated
already (checked by forcing Firefox to renew it's cached).

Thank you, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

>
> - Steve
>
>
> On Fri, 20 Jan 2012, Jan Lieskovsky wrote:
>
>> Hello Kurt, Steve, vendors,
>>
>> a denial of service flaw was found in the way asterisk processed certain
>> requests to negotiate secure video stream, when the res_srtp Asterisk module
>> has been loaded and video support has not been enabled. A remote attacker could
>> provide a specially-crafted media stream negotiation request, which once
>> processed by Asterisk would lead to asterisk daemon crash by processing crypto
>> line for such media stream.
>>
>> References:
>> [1] http://downloads.asterisk.org/pub/security/AST-2012-001.html
>> [2] https://issues.asterisk.org/jira/browse/ASTERISK-19202
>> [3] https://bugzilla.redhat.com/show_bug.cgi?id=783487
>>
>> Upstream patch against the v1.8.x branch:
>> [4] http://downloads.asterisk.org/pub/security/AST-2012-001-1.8.diff
>>
>> Upstream patch against the v1.10.x branch:
>> [5] http://downloads.asterisk.org/pub/security/AST-2012-001-10.diff
>>
>> Could you allocate a CVE identifier for this?
>>
>> Thank you && Regards, Jan.
>> --
>> Jan iankko Lieskovsky / Red Hat Security Response Team
>>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.