manager.c in Asterisk Open Source 1.6.1.x before 1.6.1.24, 1.6.2.x before 1.6.2.17.2, and 1.8.x before 1.8.3.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a series of manager sessions involving invalid data.

The remote host is affected by the vulnerability described in GLSA-201110-21 (Asterisk: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Asterisk. Please review       the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may execute code with the privileges       of the Asterisk process or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in Asterisk, an Open Source PBX and telephony toolkit.

  - CVE-2011-1147     Matthew Nicholson discovered that incorrect handling of     UDPTL packets may lead to denial of service or the     execution of arbitrary code.

  - CVE-2011-1174     Blake Cornell discovered that incorrect connection     handling in the manager interface may lead to denial of     service.

  - CVE-2011-1175     Blake Cornell and Chris May discovered that incorrect     TCP connection handling may lead to denial of service.

  - CVE-2011-1507     Tzafrir Cohen discovered that insufficient limitation of     connection requests in several TCP based services may     lead to denial of service. Please see AST-2011-005 for     details.

  - CVE-2011-1599     Matthew Nicholson discovered a privilege escalation     vulnerability in the manager interface.

The Asterisk Development Team has announced security releases for Asterisk branches 1.6.1, 1.6.2, and 1.8. The available security releases are released as versions 1.6.1.24, 1.6.2.17.2, and 1.8.3.2.
These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases ** This is a re-release of Asterisk 1.6.1.23, 1.6.2.17.1 and 1.8.3.1 which contained a bug which caused duplicate manager entries (issue #18987).
The releases of Asterisk 1.6.1.24, 1.6.2.17.2, and 1.8.3.2 resolve two issues :

  - Resource exhaustion in Asterisk Manager Interface     (AST-2011-003)

    - Remote crash vulnerability in TCP/TLS server       (AST-2011-004) The issues and resolutions are       described in the AST-2011-003 and AST-2011-004       security advisories. For more information about the       details of these vulnerabilities, please read the       security advisories AST-2011-003 and AST-2011-004,       which were released at the same time as this       announcement. For a full list of changes in the       current releases, please see the ChangeLog:
      http://downloads.asterisk.org/pub/telephony/asterisk/r       eleases/ChangeLog-1.6.1.24       http://downloads.asterisk.org/pub/telephony/asterisk/r       eleases/ChangeLog-1.6.2.17.2       http://downloads.asterisk.org/pub/telephony/asterisk/r       eleases/ChangeLog-1.8.3.2 Security advisory       AST-2011-003 and AST-2011-004 are available at:
      http://downloads.asterisk.org/pub/security/AST-2011-00       3.pdf       http://downloads.asterisk.org/pub/security/AST-2011-00       4.pdf

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Asterisk running on the remote host may be vulnerable to multiple denial of service vulnerabilities : 

  - A resource exhaustion issue exists in the Asterisk manager interface. (AST-2011-003)

  - A NULL pointer dereference issue exists in the TCP/TLS server. (AST-2011-004)

According to the version in its SIP banner, the version of Asterisk running on the remote host may be affected by multiple denial of service vulnerabilities :

  - A resource exhaustion issue exists in the Asterisk     manager interface.

  - A NULL pointer dereference issue exists in the     TCP/TLS server.

ID	Name	Product	Family	Severity
56625	GLSA-201110-21 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
53558	Debian DSA-2225-1 : asterisk - several vulnerabilities	Nessus	Debian Local Security Checks	high
53243	Fedora 13 : asterisk-1.6.2.17.2-1.fc13 (2011-3945)	Nessus	Fedora Local Security Checks	medium
53242	Fedora 14 : asterisk-1.6.2.17.2-1.fc14 (2011-3942)	Nessus	Fedora Local Security Checks	medium
53200	Fedora 15 : asterisk-1.8.3.2-1.fc15 (2011-3958)	Nessus	Fedora Local Security Checks	medium
5825	Asterisk Multiple Denial of Service Vulnerabilities (AST-2011-003/AST-2011-004)	Nessus Network Monitor	Generic	medium
52714	Asterisk Multiple Denial of Service Vulnerabilities (AST-2011-003 / AST-2011-004)	Nessus	Denial of Service	medium

Detections

Analytics

CVE-2011-1174

high

Tenable Plugins

high

high

medium

medium

medium

medium

medium