Multiple stack-based and heap-based buffer overflows in the (1) decode_open_type and (2) udptl_rx_packet functions in main/udptl.c in Asterisk Open Source 1.4.x before 1.4.39.2, 1.6.1.x before 1.6.1.22, 1.6.2.x before 1.6.2.16.2, and 1.8 before 1.8.2.4; Business Edition C.x.x before C.3.6.3; AsteriskNOW 1.5; and s800i (Asterisk Appliance), when T.38 support is enabled, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UDPTL packet.

The remote host is affected by the vulnerability described in GLSA-201110-21 (Asterisk: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Asterisk. Please review       the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may execute code with the privileges       of the Asterisk process or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in Asterisk, an Open Source PBX and telephony toolkit.

  - CVE-2011-1147     Matthew Nicholson discovered that incorrect handling of     UDPTL packets may lead to denial of service or the     execution of arbitrary code.

  - CVE-2011-1174     Blake Cornell discovered that incorrect connection     handling in the manager interface may lead to denial of     service.

  - CVE-2011-1175     Blake Cornell and Chris May discovered that incorrect     TCP connection handling may lead to denial of service.

  - CVE-2011-1507     Tzafrir Cohen discovered that insufficient limitation of     connection requests in several TCP based services may     lead to denial of service. Please see AST-2011-005 for     details.

  - CVE-2011-1599     Matthew Nicholson discovered a privilege escalation     vulnerability in the manager interface.

The Asterisk Development Team has announced the release of Asterisk 1.6.2.17. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/ The release of Asterisk 1.6.2.17 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following is a sample of the issues resolved in this release :

  - Resolve duplicated data in the AstDB when using     DIALGROUP() (Closes issue #18091. Reported by bunny.
    Patched by tilghman)

  - Correct issue where res_config_odbc could populate     fields with invalid data. (Closes issue #18251, #18279.
    Reported by bcnit, zerohalo. Tested by trev, jthurman,     elguero, zerohalo. Patched by tilghman)

  - When using cdr_pgsql the billsec field was not populated     correctly on unanswered calls. (Closes issue #18406.
    Reported by joscas. Patched by tilghman)

  - Resolve issue where re-transmissions of SUBSCRIBE could     break presence. (Closes issue #18075. Reported by     mdu113. Patched by twilson)

  - Fix regression causing forwarding voicemails to not work     with file storage. (Closes issue #18358. Reported by     cabal95. Patched by jpeeler)

  - This version of Asterisk includes the new Compiler Flags     option BETTER_BACKTRACES which uses libbfd to search for     better symbol information within both the Asterisk     binary, as well as loaded modules, to assist when using     inline backtraces to track down problems. (Patched by     tilghman)

  - Resolve several issues with DTMF based attended     transfers. (Closes issues #17999, #17096, #18395,     #17273. Reported by iskatel, gelo, shihchaun, grecco.
    Patched by rmudgett). NOTE: Be sure to read the     ChangeLog for more information about these changes.

  - Resolve issue where no Music On Hold may be triggered     when using res_timing_dahdi. (Closes issues #18262.
    Reported by francesco_r. Patched by cjacobson. Tested by     francesco_r, rfrantik, one47)

  - Fix regression that changed behavior of queues when     ringing a queue member. (Closes issue #18747, #18733.
    Reported by vrban. Patched by qwell.) Additionally, this     release has the changes related to security bulletin     AST-2011-002 which can be found at     http://downloads.asterisk.org/pub/security/AST-2011-002.
    pdf For a full list of changes in this release, please     see the ChangeLog:
    http://downloads.asterisk.org/pub/telephony/asterisk/Cha     ngeLog-1.6.2.17 Asterisk Project Security Advisory -     AST-2011-002 Product Asterisk Summary Multiple array     overflow and crash vulnerabilities in UDPTL code Nature     of Advisory Exploitable Stack and Heap Array Overflows     Susceptibility Remote Unauthenticated Sessions Severity     Critical Exploits Known No Reported On January 27, 2011     Reported By Matthew Nicholson Posted On February 21,     2011 Last Updated On February 21, 2011 Advisory Contact     Matthew Nicholson <mnicholson at digium.com> CVE Name     Description When decoding UDPTL packets, multiple stack     and heap based arrays can be made to overflow by     specially crafted packets. Systems doing T.38 pass     through or termination are vulnerable. Resolution The     UDPTL decoding routines have been modified to respect     the limits of exploitable arrays. In asterisk versions     not containing the fix for this issue, disabling T.38     support will prevent this vulnerability from being     exploited. T.38 support can be disabled in chan_sip by     setting the t38pt_udptl option to 'no' (it is off by     default). t38pt_udptl = no The chan_ooh323 module should     also be disabled by adding the following line in     modles.conf. noload => chan_ooh323 Affected Versions     Product Release Series Asterisk Open Source 1.4.x All     versions Asterisk Open Source 1.6.x All versions     Asterisk Business Edition C.x.x All versions AsteriskNOW     1.5 All versions s800i (Asterisk Appliance) 1.2.x All     versions Corrected In Product Release Asterisk Open     Source 1.4.39.2, 1.6.1.22, 1.6.2.16.2, 1.8.2.4 Asterisk     Business Edition C.3.6.3 Patches URL Branch     http://downloads.asterisk.org/pub/security/AST-2011-002-     1.4.diff 1.4     http://downloads.asterisk.org/pub/security/AST-2011-002-     1.6.1.diff 1.6.1     http://downloads.asterisk.org/pub/security/AST-2011-002-     1.6.2.diff 1.6.2     http://downloads.asterisk.org/pub/security/AST-2011-002-     1.8.diff 1.8 Links Asterisk Project Security Advisories     are posted at http://www.asterisk.org/security This     document may be superseded by later versions; if so, the     latest version will be posted at     http://downloads.digium.com/pub/security/AST-2011-002.pd     f and     http://downloads.digium.com/pub/security/AST-2011-002.ht     ml Revision History Date Editor Revisions Made 02/21/11     Matthew Nicholson Initial Release Asterisk Project     Security Advisory - AST-2011-002 Copyright (c) 2011     Digium, Inc. All Rights Reserved. Permission is hereby     granted to distribute and publish this advisory in its     original, unaltered form.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Asterisk Development Team has announced the release of Asterisk 1.8.3. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/ The release of Asterisk 1.8.3 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following is a sample of the issues resolved in this release :

  - Resolve duplicated data in the AstDB when using     DIALGROUP() (Closes issue #18091. Reported by bunny.
    Patched by tilghman)

  - Ensure the ipaddr field in realtime is large enough to     handle IPv6 addresses. (Closes issue #18464. Reported,     patched by IgorG)

  - Reworking parsing of mwi => lines to resolve a segfault.
    Also add a set of unit tests for the function that does     the parsing. (Closes issue #18350. Reported by gbour.
    Patched by Marquis)

  - When using cdr_pgsql the billsec field was not populated     correctly on unanswered calls. (Closes issue #18406.
    Reported by joscas. Patched by tilghman)

  - Resolve memory leak in iCalendar and Exchange     calendaring modules. (Closes issue #18521. Reported,     patched by pitel. Tested by cervajs)

  - This version of Asterisk includes the new Compiler Flags     option BETTER_BACKTRACES which uses libbfd to search for     better symbol information within both the Asterisk     binary, as well as loaded modules, to assist when using     inline backtraces to track down problems. (Patched by     tilghman)

  - Resolve issue where no Music On Hold may be triggered     when using res_timing_dahdi. (Closes issues #18262.
    Reported by francesco_r. Patched by cjacobson. Tested by     francesco_r, rfrantik, one47)

  - Resolve a memory leak when the Asterisk Manager     Interface is disabled. (Reported internally by kmorgan.
    Patched by russellb)

  - Reimplemented fax session reservation to reverse the ABI     breakage introduced in r297486. (Reported internally.
    Patched by mnicholson)

  - Fix regression that changed behavior of queues when     ringing a queue member. (Closes issue #18747, #18733.
    Reported by vrban. Patched by qwell.)

  - Resolve deadlock involving REFER. (Closes issue #18403.
    Reported, tested by jthurman. Patched by jpeeler.)     Additionally, this release has the changes related to     security bulletin AST-2011-002 which can be found at     http://downloads.asterisk.org/pub/security/AST-2011-002.
    pdf For a full list of changes in this release, please     see the ChangeLog:
    http://downloads.asterisk.org/pub/telephony/asterisk/Cha     ngeLog-1.8.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Asterisk running on the remote host may be vulnerable to heap- and stack-buffer overflow attacks with specially crafted UDPTL packets.

Successful exploitation requires T.38 support to be enabled on the target, which is not the default, and can allow execution of arbitrary code in the context of the Asterisk server or an application crash.

According to the version in its SIP banner, the version of Asterisk running on the remote host may be vulnerable to heap- and stack-buffer overflow attacks with specially crafted UDPTL packets.

Successful exploitation requires T.38 support to be enabled on the target, which is not the default, and can allow execution of arbitrary code in the context of the Asterisk server or an application crash.

Note that Nessus has not determined whether T.38 is actually enabled so this finding may be a false positive.

ID	Name	Product	Family	Severity
56625	GLSA-201110-21 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
53558	Debian DSA-2225-1 : asterisk - several vulnerabilities	Nessus	Debian Local Security Checks	high
52639	Fedora 13 : asterisk-1.6.2.17-1.fc13 (2011-2558)	Nessus	Fedora Local Security Checks	medium
52602	Fedora 14 : asterisk-1.6.2.17-1.fc14 (2011-2438)	Nessus	Fedora Local Security Checks	medium
52561	Fedora 15 : asterisk-1.8.3-1.fc15 (2011-2360)	Nessus	Fedora Local Security Checks	medium
5802	Asterisk main/udptl.c Buffer Overflows (AST-2011-002)	Nessus Network Monitor	Generic	high
52157	Asterisk main/udptl.c Buffer Overflows (AST-2011-002)	Nessus	Gain a shell remotely	high

Detections

Analytics

CVE-2011-1147

critical

Tenable Plugins

high

high

medium

medium

medium

high

high