Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop.

The remote host is affected by the vulnerability described in GLSA-201401-15 (Asterisk: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Asterisk. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code with the privileges of       the process, cause a Denial of Service condition, or obtain sensitive       information.
  Workaround :

    There is no known workaround at this time.

- Sat Dec 28 2013 Jeffrey Ollie <jeff at ocjtech.us> -     11.7.0-1 :

    - The Asterisk Development Team has announced the       release of Asterisk 11.7.0.

    - This release is available for immediate download at

    - http://downloads.asterisk.org/pub/telephony/asterisk

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jan Juergens discovered a buffer overflow in the parser for SMS messages in Asterisk.

An additional change was backported, which is fully described in http://downloads.asterisk.org/pub/security/AST-2013-007.html

With the fix for AST-2013-007, a new configuration option was added in order to allow the system administrator to disable the expansion of'dangerous' functions (such as SHELL()) from any interface which is not the dialplan. In stable and oldstable this option is disabled by default. To enable it add the following line to the section '[options]' in /etc/asterisk/asterisk.conf (and restart asterisk)

live_dangerously = no

A vulnerability has been discovered and corrected in asterisk :

Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message (CVE-2013-7100).

The updated packages has been upgraded to the 11.7.0 version which resolves various upstream bugs and is not vulnerable to this issue.

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the     'unpacksms16()' function of the 'app_sms.c' source file.
    When a 16-bit SMS message with an unusual message length     value is received, an infinite loop will be created,     causing a denial of service.

  - A privilege escalation vulnerability exists because of     the way dialplan functions are handled during variable     substitution.  Privileged dialplan functions, such as     the SHELL() and FILE() functions, can be used by     external control protocols, such as the Asterisk Manager     Interface and Asterisk Gateway Interface.  A malicious,     authenticated user could use these functions to modify     arbitrary files or execute arbitrary commands.

The Asterisk project reports :

A 16 bit SMS message that contains an odd message length value will cause the message decoding loop to run forever. The message buffer is not on the stack but will be overflowed resulting in corrupted memory and an immediate crash.

External control protocols, such as the Asterisk Manager Interface, often have the ability to get and set channel variables; this allows the execution of dialplan functions. Dialplan functions within Asterisk are incredibly powerful, which is wonderful for building applications using Asterisk. But during the read or write execution, certain diaplan functions do much more. For example, reading the SHELL() function can execute arbitrary commands on the system Asterisk is running on. Writing to the FILE() function can change any file that Asterisk has write access to. When these functions are executed from an external protocol, that execution could result in a privilege escalation.

ID	Name	Product	Family	Severity
72054	GLSA-201401-15 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
71871	Fedora 18 : asterisk-11.7.0-1.fc18 (2013-24142)	Nessus	Fedora Local Security Checks	medium
71870	Fedora 19 : asterisk-11.7.0-1.fc19 (2013-24119)	Nessus	Fedora Local Security Checks	medium
71868	Fedora 20 : asterisk-11.7.0-1.fc20 (2013-24108)	Nessus	Fedora Local Security Checks	medium
71848	Debian DSA-2835-1 : asterisk - buffer overflow	Nessus	Debian Local Security Checks	medium
71607	Mandriva Linux Security Advisory : asterisk (MDVSA-2013:300)	Nessus	Mandriva Local Security Checks	medium
71538	Asterisk Multiple Vulnerabilities (AST-2013-006 / AST-2013-007)	Nessus	Misc.	medium
71506	FreeBSD : asterisk -- multiple vulnerabilities (0c39bafc-6771-11e3-868f-0025905a4771)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2013-7100

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium