Asterisk 1.2.17 fixes SIP DoS vulnerability

Security change in ChangeLog:

2007-03-14 16:38 +0000 [r58896] Russell Bryant <email address hidden>

 * SECURITY: Add a note to the security file that the Asterisk CLI
   and log files may contain sensitive information, and that people
   should keep this in mind.

Lol, wrong ChangeLog entry.. Extracting the right one..

This looks right:

http://svn.digium.com/view/asterisk/branches/1.2/channels/chan_sip.c?r1=56230&r2=57475

If a SIP message comes in and goes to a method handler that requires additional values that may not be present then send back an error.

Compare http://voipsa.org/pipermail/voipsec_voipsa.org/2007-March/002275.html (also the date).

I will run an exploit against my Asterisk if one available to verify that this patch fixes the problem.

Sadly I was not able to find an exploit and thus could not make sure that this path fixes the issue.

"hi, pirast: that was indeed the revision that provided a fix for
vulnerability in Mu Security's advisory. Please note that the following
line was changed later on in rev.58052

-transmit_response(p, "503 Server error", req);
+transmit_response(p, "400 Bad request", req "

The above commit was what was released for the 1.2.16 update (CVE-2007-1306). I suspect the new issue (which needs a CVE) was fixed with this commit:

http://svn.digium.com/view/asterisk/branches/1.2/channels/chan_sip.c?r1=58115&r2=58579

Note that as described in the announcement, if an invalid IP is included on a connection line, the resulting hp-> deref will segfault without the above return -1.

I imagine using "sipsak", you could produce the needed values. There are some example protocol dumps that include the "c=IN IP4" lines here:

http://www.ietf.org/internet-drafts/draft-ietf-sip-connected-identity-05.txt

Ho hum, probably that was not the right patch, we already applied it in the previous bug report and it really fixes the (old) exploit. Probably the person I quoted is speaking about the old security problem :(

57475 is included in 1.2.16, searching a new patch now :(

Lol Kees you were faster than me...

Kees, you were right, http://svn.digium.com/view/asterisk/branches/1.2/channels/chan_sip.c?r1=58115&r2=58579 fixes the issue.

Here: http://bugs.digium.com/view.php?id=9203

at the bottom it says so..

Feisty debdiff, please apply :)

Edgy debdiff, please check & apply :)

Building updates now.

Uploaded to the archive; they should be available soon.