Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame.

Updated asterisk packages fix security vulnerability :

Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame (CVE-2014-9374).

The remote host is affected by the vulnerability described in GLSA-201412-51 (Asterisk: Multiple vulnerabilities)

    Multiple unspecified vulnerabilities have been discovered in Asterisk.
      Please review the CVE identifiers referenced below for details.
  Impact :

    Unauthenticated remote attackers can cause Denial of Service or bypass       intended ACL restrictions. Authenticated remote attackers can gain       escalated privileges.
  Workaround :

    There is no known workaround at this time.

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by a double-free error related to the 'res_http_websocket' module and handling of zero-length payloads that could allow denial of service attacks.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Asterisk project reports :

When handling a WebSocket frame the res_http_websocket module dynamically changes the size of the memory used to allow the provided payload to fit. If a payload length of zero was received the code would incorrectly attempt to resize to zero. This operation would succeed and end up freeing the memory but be treated as a failure.
When the session was subsequently torn down this memory would get freed yet again causing a crash.

Users of the WebSocket functionality also did not take into account that provided text frames are not guaranteed to be NULL terminated.
This has been fixed in chan_sip and chan_pjsip in the applicable versions.

ID	Name	Product	Family	Severity
80437	Mandriva Linux Security Advisory : asterisk (MDVSA-2015:018)	Nessus	Mandriva Local Security Checks	medium
80272	GLSA-201412-51 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
80036	Asterisk 'res_http_websocket' Double-Free DoS (AST-2014-019)	Nessus	Misc.	medium
79956	FreeBSD : asterisk -- Remote Crash Vulnerability in WebSocket Server (94268da0-8118-11e4-a180-001999f8d30b)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2014-9374

high

Tenable Plugins

medium

high

medium

medium