The handle_request_info function in channels/chan_sip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted sequence of SIP requests.

Update to 1.8.10.1, which fixes 2 security vulnerabilities. The Asterisk Development Team has announced security releases for Asterisk 1.4, 1.6.2 and 1.8. The available security releases are released as versions 1.4.43, 1.6.2.21 and 1.8.7.2.

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The release of Asterisk versions 1.4.43, 1.6.2.21, and 1.8.7.2 resolves an issue with possible remote enumeration of SIP endpoints with differing NAT settings.

The release of Asterisk versions 1.6.2.21 and 1.8.7.2 resolves a remote crash possibility with SIP when the 'automon' feature is enabled.

The issues and resolutions are described in the AST-2011-013 and AST-2011-014 security advisories.

For more information about the details of these vulnerabilities, please read the security advisories AST-2011-013 and AST-2011-014, which were released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLogs :

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.4.43 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.6.2.21 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLo g-1.8.7.2

Security advisory AST-2011-013 is available at :

  -     http://downloads.asterisk.org/pub/security/AST-2011-013.
    pdf

Security advisory AST-2011-014 is available at :

  -     http://downloads.asterisk.org/pub/security/AST-2011-014.
    pdf

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in Asterisk, an Open Source PBX and telephony toolkit :

  - CVE-2011-4597     Ben Williams discovered that it was possible to     enumerate SIP user names in some configurations. Please     see the upstream advisory for details.

  This update only modifies the sample sip.conf configuration file.
  Please see README.Debian for more information on how to update your   installation.

  - CVE-2011-4598     Kristijan Vrban discovered that Asterisk can be crashed     with malformed SIP packets if the 'automon' feature is     enabled.

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by the following vulnerabilities :

  - An issue in the SIP protocol can lead to the enumeration     of endpoints with NAT settings different from the     default. Note that this is an issue with the SIP     protocol itself, and that updated versions of Asterisk     provide warnings and safer defaults. (AST-2011-013)

  - A NULL pointer derefererence can lead to an application     crash by a remote, unauthenticated user when processing     a SIP request. Note that successful exploitation     requires that the 'automon' feature in features.conf be     enabled and that it is not by default. (AST-2011-014)

Asterisk project reports :

It is possible to enumerate SIP usernames when the general and user/peer NAT settings differ in whether to respond to the port a request is sent from or the port listed for responses in the Via header.

When the 'automon' feature is enabled in features.conf, it is possible to send a sequence of SIP requests that cause Asterisk to dereference a NULL pointer and crash.

ID	Name	Product	Family	Severity
58549	Fedora 15 : asterisk-1.8.10.1-1.fc15 (2012-4259)	Nessus	Fedora Local Security Checks	high
57507	Debian DSA-2367-1 : asterisk - several vulnerabilities	Nessus	Debian Local Security Checks	medium
57289	Asterisk Multiple Vulnerabilities (AST-2011-013 / AST-2011-014)	Nessus	Misc.	medium
57051	FreeBSD : asterisk -- Multiple Vulnerabilities (bb389137-21fb-11e1-89b4-001ec9578670)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2011-4598

high

Tenable Plugins

high

medium

medium

medium