Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.

This update fixes 2 security problem in the PBX software Asterisk.

CVE-2006-5444: Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.

CVE-2006-5445: A vulnerability in the SIP channel driver (channels/chan_sip.c) in Asterisk on SUSE Linux 10.1 allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors that result in the creation of 'a real pvt structure' that uses more resources than necessary.

Adam Boileau discovered an integer overflow in the Skinny channel driver in Asterisk, an Open Source Private Branch Exchange or telephone system, as used by Cisco SCCP phones, which allows remote attackers to execute arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200610-15 (Asterisk: Multiple vulnerabilities)

    Asterisk contains buffer overflows in channels/chan_mgcp.c from the     MGCP driver and in channels/chan_skinny.c from the Skinny channel     driver for Cisco SCCP phones. It also dangerously handles     client-controlled variables to determine filenames in the Record()     function. Finally, the SIP channel driver in channels/chan_sip.c could     use more resources than necessary under unspecified circumstances.
  Impact :

    A remote attacker could execute arbitrary code by sending a crafted     audit endpoint (AUEP) response, by sending an overly large Skinny     packet even before authentication, or by making use of format strings     specifiers through the client-controlled variables. An attacker could     also cause a Denial of Service by resource consumption through the SIP     channel driver.
  Workaround :

    There is no known workaround for the format strings vulnerability at     this time. You can comment the lines in /etc/asterisk/mgcp.conf,     /etc/asterisk/skinny.conf and /etc/asterisk/sip.conf to deactivate the     three vulnerable channel drivers. Please note that the MGCP channel     driver is disabled by default.

The chan_skinny channel driver included in the version of Asterisk running on the remote host does not properly validate the length header in incoming packets.  An unauthenticated, remote attacker may be able to leverage this flaw to execute code on the affected host subject to the privileges under which Asterisk runs, generally root.

ID	Name	Product	Family	Severity
27156	openSUSE 10 Security Update : asterisk (asterisk-2272)	Nessus	SuSE Local Security Checks	high
23790	Debian DSA-1229-1 : asterisk - integer overflow	Nessus	Debian Local Security Checks	high
22930	GLSA-200610-15 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
22878	Asterisk Skinny Channel Driver (chan_skinny) get_input Function Remote Overflow	Nessus	Gain a shell remotely	high

Detections

Analytics

CVE-2006-5444

critical

Tenable Plugins

high

high

high

high