Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers to cause a denial of service (file descriptor exhaustion and disk space exhaustion) via a series of TCP connections.

The remote host is affected by the vulnerability described in GLSA-201110-21 (Asterisk: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Asterisk. Please review       the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may execute code with the privileges       of the Asterisk process or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The Asterisk Development Team has announced the release of Asterisk 1.6.2.18. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The release of Asterisk 1.6.2.18 resolves several issues reported by the community and would have not been possible without your participation. Thank you!

The following is a sample of the issues resolved in this release :

  - Only offer codecs both sides support for directmedia.
    (Closes issue #17403. Reported, patched by one47)

  - Resolution of several DTMF based attended transfer     issues. (Closes issue #17999, #17096, #18395, #17273.
    Reported by iskatel, gelo, shihchuan, grecco. Patched by     rmudgett) NOTE: Be sure to read the ChangeLog for more     information about these changes.

  - Resolve deadlocks related to device states in chan_sip     (Closes issue #18310. Reported, patched by one47.
    Patched by jpeeler)

  - Fix channel redirect out of MeetMe() and other issues     with channel softhangup (Closes issue #18585. Reported     by oej. Tested by oej, wedhorn, russellb. Patched by     russellb)

  - Fix voicemail sequencing for file based storage. (Closes     issue #18498, #18486. Reported by JJCinAZ, bluefox.
    Patched by jpeeler)

  - Guard against retransmitting BYEs indefinitely during     attended transfers with chan_sip. (Review:
    https://reviewboard.asterisk.org/r/1077/)

In addition to the changes listed above, commits to resolve security issues AST-2011-005 and AST-2011-006 have been merged into this release. More information about AST-2011-005 and AST-2011-006 can be found at :

http://downloads.asterisk.org/pub/security/AST-2011-005.pdf http://downloads.asterisk.org/pub/security/AST-2011-006.pdf

For a full list of changes in this release, please see the ChangeLog :

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.2.1 8

The Asterisk Development Team has announced security releases for Asterisk branches 1.4, 1.6.1, 1.6.2, and 1.8. The available security releases are released as versions 1.4.40.1, 1.6.1.25, 1.6.2.17.3, and 1.8.3.3.

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The releases of Asterisk 1.4.40.1, 1.6.1.25, 1.6.2.17.3, and 1.8.3.3 resolve two issues :

  - File Descriptor Resource Exhaustion (AST-2011-005)

    - Asterisk Manager User Shell Access (AST-2011-006)

The issues and resolutions are described in the AST-2011-005 and AST-2011-006 security advisories.

For more information about the details of these vulnerabilities, please read the security advisories AST-2011-005 and AST-2011-006, which were released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLog :

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.4.40.1 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.6.1.25 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.6.2.17.3 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.8.3.3

Security advisory AST-2011-005 and AST-2011-006 are available at :

http://downloads.asterisk.org/pub/security/AST-2011-005.pdf http://downloads.asterisk.org/pub/security/AST-2011-006.pdf

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Asterisk Development Team has announced the release of Asterisk 1.6.2.18. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The release of Asterisk 1.6.2.18 resolves several issues reported by the community and would have not been possible without your participation. Thank you!

The following is a sample of the issues resolved in this release :

  - Only offer codecs both sides support for directmedia.
    (Closes issue #17403. Reported, patched by one47)

  - Resolution of several DTMF based attended transfer     issues. (Closes issue #17999, #17096, #18395, #17273.
    Reported by iskatel, gelo, shihchuan, grecco. Patched by     rmudgett) NOTE: Be sure to read the ChangeLog for more     information about these changes.

  - Resolve deadlocks related to device states in chan_sip     (Closes issue #18310. Reported, patched by one47.
    Patched by jpeeler)

  - Fix channel redirect out of MeetMe() and other issues     with channel softhangup (Closes issue #18585. Reported     by oej. Tested by oej, wedhorn, russellb. Patched by     russellb)

  - Fix voicemail sequencing for file based storage. (Closes     issue #18498, #18486. Reported by JJCinAZ, bluefox.
    Patched by jpeeler)

  - Guard against retransmitting BYEs indefinitely during     attended transfers with chan_sip. (Review:
    https://reviewboard.asterisk.org/r/1077/)

In addition to the changes listed above, commits to resolve security issues AST-2011-005 and AST-2011-006 have been merged into this release. More information about AST-2011-005 and AST-2011-006 can be found at :

http://downloads.asterisk.org/pub/security/AST-2011-005.pdf http://downloads.asterisk.org/pub/security/AST-2011-006.pdf

For a full list of changes in this release, please see the ChangeLog :

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.2.1 8 The Asterisk Development Team has announced security releases for Asterisk branches 1.4, 1.6.1, 1.6.2, and 1.8. The available security releases are released as versions 1.4.40.1, 1.6.1.25, 1.6.2.17.3, and 1.8.3.3.

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The releases of Asterisk 1.4.40.1, 1.6.1.25, 1.6.2.17.3, and 1.8.3.3 resolve two issues :

  - File Descriptor Resource Exhaustion (AST-2011-005)

    - Asterisk Manager User Shell Access (AST-2011-006)

The issues and resolutions are described in the AST-2011-005 and AST-2011-006 security advisories.

For more information about the details of these vulnerabilities, please read the security advisories AST-2011-005 and AST-2011-006, which were released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLog :

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.4.40.1 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.6.1.25 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.6.2.17.3 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.8.3.3

Security advisory AST-2011-005 and AST-2011-006 are available at :

http://downloads.asterisk.org/pub/security/AST-2011-005.pdf http://downloads.asterisk.org/pub/security/AST-2011-006.pdf

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Asterisk Development Team has announced security releases for Asterisk branches 1.4, 1.6.1, 1.6.2, and 1.8. The available security releases are released as versions 1.4.40.1, 1.6.1.25, 1.6.2.17.3, and 1.8.3.3.

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The releases of Asterisk 1.4.40.1, 1.6.1.25, 1.6.2.17.3, and 1.8.3.3 resolve two issues :

  - File Descriptor Resource Exhaustion (AST-2011-005)

    - Asterisk Manager User Shell Access (AST-2011-006)

The issues and resolutions are described in the AST-2011-005 and AST-2011-006 security advisories.

For more information about the details of these vulnerabilities, please read the security advisories AST-2011-005 and AST-2011-006, which were released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLog :

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.4.40.1 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.6.1.25 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.6.2.17.3 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.8.3.3

Security advisory AST-2011-005 and AST-2011-006 are available at :

http://downloads.asterisk.org/pub/security/AST-2011-005.pdf http://downloads.asterisk.org/pub/security/AST-2011-006.pdf

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in Asterisk, an Open Source PBX and telephony toolkit.

  - CVE-2011-1147     Matthew Nicholson discovered that incorrect handling of     UDPTL packets may lead to denial of service or the     execution of arbitrary code.

  - CVE-2011-1174     Blake Cornell discovered that incorrect connection     handling in the manager interface may lead to denial of     service.

  - CVE-2011-1175     Blake Cornell and Chris May discovered that incorrect     TCP connection handling may lead to denial of service.

  - CVE-2011-1507     Tzafrir Cohen discovered that insufficient limitation of     connection requests in several TCP based services may     lead to denial of service. Please see AST-2011-005 for     details.

  - CVE-2011-1599     Matthew Nicholson discovered a privilege escalation     vulnerability in the manager interface.

The version of Asterisk running on the remote host is potentially affected by multiple issues : 

  - On systems that have the Asterisk Manager interface, Skinny, SIP over TCP, or the built in HTTP server enabled, it is possible for an attacker to open as many connections to asterisk as he wishes which would cause Asterisk to run out of available file descriptors and stop processing any new calls. (AST-2011-005)

  - It is possible to bypass a security check and execute shell commands when they should not have that ability.  Note that only users with the 'system' privileges should be able to do this. (AST-2011-006)

According to the version in its SIP banner, the version of Asterisk running on the remote host may be affected by multiple denial of service vulnerabilities :

  - On systems that have the Asterisk Manager interface,     Skinny, SIP over TCP, or the built-in HTTP server     enabled, it is possible for an attacker to open an     unlimited number of connections to Asterisk, which would     cause Asterisk to run out of available file descriptors     and stop processing any new calls. (AST-2011-005)

  - It is possible to bypass a security check and execute     shell commands when they should not have that ability.
    Note that only users with the 'system' privilege should     be able to do this. (AST-2011-006)

The Asterisk Development Team reports :

It is possible for a user of the Asterisk Manager Interface to bypass a security check and execute shell commands when they should not have that ability. Sending the 'Async' header with the 'Application' header during an Originate action, allows authenticated manager users to execute shell commands. Only users with the 'system' privilege should be able to do this.

On systems that have the Asterisk Manager Interface, Skinny, SIP over TCP, or the built in HTTP server enabled, it is possible for an attacker to open as many connections to asterisk as he wishes. This will cause Asterisk to run out of available file descriptors and stop processing any new calls. Additionally, disk space can be exhausted as Asterisk logs failures to open new file descriptors.

ID	Name	Product	Family	Severity
56625	GLSA-201110-21 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
54286	Fedora 14 : asterisk-1.6.2.18-1.fc14 (2011-6225)	Nessus	Fedora Local Security Checks	high
53835	Fedora 13 : asterisk-1.6.2.18-1.fc13 (2011-6208)	Nessus	Fedora Local Security Checks	high
53566	Fedora 15 : asterisk-1.8.3.3-1.fc15 (2011-5835)	Nessus	Fedora Local Security Checks	high
53558	Debian DSA-2225-1 : asterisk - several vulnerabilities	Nessus	Debian Local Security Checks	high
5897	Asterisk Multiple Vulnerabilities (AST-2011-005/AST-2011-006)	Nessus Network Monitor	Generic	medium
53544	Asterisk Multiple Vulnerabilities (AST-2011-005 / AST-2011-006)	Nessus	Denial of Service	medium
53523	FreeBSD : Asterisk -- multiple vulnerabilities (3c7d565a-6c64-11e0-813a-6c626dd55a41)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2011-1507

high

Tenable Plugins

high

high

high

high

high

medium

medium

medium