[ GLSA 200905-01 ] Asterisk: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: Asterisk: Multiple vulnerabilities (GLSA 200905-01)
Severity: normal
Exploitable: remote
Date: May 02, 2009
Bug(s): #218966, #224835, #232696, #232698, #237476, #250748, #254304
ID: 200905-01

Synopsis


Multiple vulnerabilities have been found in Asterisk allowing for Denial of
Service and username disclosure.


Background


Asterisk is an open source telephony engine and toolkit.


Affected Packages

Package: net-misc/asterisk
Vulnerable: < 1.2.32
Unaffected: >= 1.2.32
Architectures: All supported architectures


Description


Multiple vulnerabilities have been discovered in the IAX2 channel
driver when performing the 3-way handshake (CVE-2008-1897), when
handling a large number of POKE requests (CVE-2008-3263), when handling
authentication attempts (CVE-2008-5558) and when handling firmware
download (FWDOWNL) requests (CVE-2008-3264). Asterisk does also not
correctly handle SIP INVITE messages that lack a "From" header
(CVE-2008-2119), and responds differently to a failed login attempt
depending on whether the user account exists (CVE-2008-3903,
CVE-2009-0041).


Impact


Remote unauthenticated attackers could send specially crafted data to
Asterisk, possibly resulting in a Denial of Service via a daemon crash,
call-number exhaustion, CPU or traffic consumption. Remote
unauthenticated attackers could furthermore enumerate valid usernames
to facilitate brute force login attempts.


Workaround


There is no known workaround at this time.


Resolution


All Asterisk users should upgrade to the latest version: