The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.

This update fixes multiple bugs that allowed attackers to remotely crash asterisk or cause an information leak (CVE-2007-1561, CVE-2007-1594, CVE-2007-1595, CVE-2007-2297, CVE-2007-2488).

Several remote vulnerabilities have been discovered in Asterisk, a free software PBX and telephony toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1306     'Mu Security' discovered that a NULL pointer dereference     in the SIP implementation could lead to denial of     service.

  - CVE-2007-1561     Inria Lorraine discovered that a programming error in     the SIP implementation could lead to denial of service.

  - CVE-2007-2294     It was discovered that a NULL pointer dereference in the     manager interface could lead to denial of service.

  - CVE-2007-2297     It was discovered that a programming error in the SIP     implementation could lead to denial of service.

  - CVE-2007-2488     Tim Panton and Birgit Arkestein discovered that a     programming error in the IAX2 implementation could lead     to information disclosure.

  - CVE-2007-3762     Russell Bryant discovered that a buffer overflow in the     IAX implementation could lead to the execution of     arbitrary code.

  - CVE-2007-3763     Chris Clark and Zane Lackey discovered that several NULL     pointer dereferences in the IAX2 implementation could     lead to denial of service.

  - CVE-2007-3764     Will Drewry discovered that a programming error in the     Skinny implementation could lead to denial of service.

The remote host is affected by the vulnerability described in GLSA-200704-01 (Asterisk: Two SIP Denial of Service vulnerabilities)

    The Madynes research team at INRIA has discovered that Asterisk     contains a NULL pointer dereferencing error in the SIP channel when     handling INVITE messages. Furthermore qwerty1979 discovered that     Asterisk 1.2.x fails to properly handle SIP responses with return code     0.
  Impact :

    A remote attacker could cause an Asterisk server listening for SIP     messages to crash by sending a specially crafted SIP message or     answering with a 0 return code.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
27157	openSUSE 10 Security Update : asterisk (asterisk-3543)	Nessus	SuSE Local Security Checks	critical
25938	Debian DSA-1358-1 : asterisk - several vulnerabilities	Nessus	Debian Local Security Checks	critical
24934	GLSA-200704-01 : Asterisk: Two SIP Denial of Service vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2007-1561

high

Tenable Plugins

critical

critical

high