Fedora 15 : asterisk-1.8.10.1-1.fc15 (2012-4259)

high Nessus Plugin ID 58549

Synopsis

The remote Fedora host is missing a security update.

Description

Update to 1.8.10.1, which fixes 2 security vulnerabilities. The Asterisk Development Team has announced security releases for Asterisk 1.4, 1.6.2 and 1.8. The available security releases are released as versions 1.4.43, 1.6.2.21 and 1.8.7.2.

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The release of Asterisk versions 1.4.43, 1.6.2.21, and 1.8.7.2 resolves an issue with possible remote enumeration of SIP endpoints with differing NAT settings.

The release of Asterisk versions 1.6.2.21 and 1.8.7.2 resolves a remote crash possibility with SIP when the 'automon' feature is enabled.

The issues and resolutions are described in the AST-2011-013 and AST-2011-014 security advisories.

For more information about the details of these vulnerabilities, please read the security advisories AST-2011-013 and AST-2011-014, which were released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLogs :

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.4.43 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.6.2.21 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.8.7.2

Security advisory AST-2011-013 is available at :

- http://downloads.asterisk.org/pub/security/AST-2011-013.
pdf

Security advisory AST-2011-014 is available at :

- http://downloads.asterisk.org/pub/security/AST-2011-014.
pdf

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected asterisk package.

See Also

http://downloads.asterisk.org/pub/security/AST-2011-013.pdf

http://downloads.asterisk.org/pub/security/AST-2011-014.pdf

http://downloads.asterisk.org/pub/telephony/asterisk/releases/

http://www.nessus.org/u?5d3e0301

http://www.nessus.org/u?de7eb2c6

http://www.nessus.org/u?6c680dc0

https://bugzilla.redhat.com/show_bug.cgi?id=765773

https://bugzilla.redhat.com/show_bug.cgi?id=765776

https://bugzilla.redhat.com/show_bug.cgi?id=804038

https://bugzilla.redhat.com/show_bug.cgi?id=804042

http://www.nessus.org/u?a5fa7bf9

Plugin Details

Severity: High

ID: 58549

File Name: fedora_2012-4259.nasl

Version: 1.14

Type: local

Agent: unix

Published: 4/2/2012

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:asterisk, cpe:/o:fedoraproject:fedora:15

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/21/2012

Exploitable With

Core Impact

Reference Information

CVE: CVE-2011-4597, CVE-2011-4598, CVE-2012-1183, CVE-2012-1184

BID: 50989, 50990, 52523, 52815

FEDORA: 2012-4259