[asterisk-users] AST-2017-013: DOS Vulnerability in Asterisk chan_skinny
Asterisk Project Security Advisory - AST-2017-013 Product Asterisk Summary DOS Vulnerability in Asterisk chan_skinny Nature of Advisory Denial of Service Susceptibility Remote Unauthenticated Sessions SeverityModerate Exploits Known Yes Reported On November 30, 2017 Reported By Juan Sacco Posted OnDecember 1, 2017 Last Updated On December 1, 2017 Advisory Contactgjoseph AT digium DOT com CVE Name Description If the chan_skinny (AKA SCCP protocol) channel driver is flooded with certain requests it can cause the asterisk process to use excessive amounts of virtual memory eventually causing asterisk to stop processing requests of any kind. Resolution The chan_skinny driver has been updated to release memory allocations in a correct manner thereby preventing any possiblity of exhaustion. Affected Versions Product Release Series Asterisk Open Source 13.x All Versions Asterisk Open Source 14.x All Versions Asterisk Open Source 15.x All Versions Certified Asterisk 13.13 All Versions Corrected In Product Release Asterisk Open Source 13.18.3, 14.7.3, 15.1.3 Certified Asterisk 13.13-cert8 Patches SVN URL Revision http://downloads.asterisk.org/pub/security/AST-2017-013-13.diffAsterisk 13 http://downloads.asterisk.org/pub/security/AST-2017-013-14.diffAsterisk 14 http://downloads.asterisk.org/pub/security/AST-2017-013-15.diffAsterisk 15 http://downloads.asterisk.org/pub/security/AST-2017-013-13.13.diff Certified Asterisk 13.13 Links https://issues.asterisk.org/jira/browse/ASTERISK-27452 Asterisk Project Security Advisories are posted at http://www.asterisk.org/security This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2017-013.pdf and http://downloads.digium.com/pub/security/AST-2017-013.html Revision History Date Editor Revisions Made November 30, 2017 George Joseph Initial Revision Asterisk Project Security Advisory - AST-2017-013 Copyright © 2017 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form. -- _ -- Bandwidth and Colocation Provided by http://www.api-digital.com -- Check out the new Asterisk community forum at: https://community.asterisk.org/ New to Asterisk? Start here: https://wiki.asterisk.org/wiki/display/AST/Getting+Started asterisk-users mailing list To UNSUBSCRIBE or update options visit: http://lists.digium.com/mailman/listinfo/asterisk-users
[asterisk-users] :
The Asterisk Development Team has announced security releases for Certified Asterisk 13.13 and Asterisk 13, 14 and 15. The available security releases are released as versions 13.13-cert8, 13.18.3, 14.7.3 and 15.1.3. These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases The release of these versions resolves the following security vulnerabilities: * AST-2017-013: DOS Vulnerability in Asterisk chan_skinny If the chan_skinny (AKA SCCP protocol) channel driver is flooded with certain requests it can cause the asterisk process to use excessive amounts of virtual memory eventually causing asterisk to stop processing requests of any kind. For a full list of changes in the current releases, please see the ChangeLogs: http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.18.3 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog=14.7.3 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-15.1.3 http://downloads.asterisk.org/pub/telephony/certified-asterisk/ChangeLog-certified-13.13-cert8 The security advisories are available at: http://downloads.asterisk.org/pub/security/AST-2017-013.pdf Thank you for your continued support of Asterisk! -- _ -- Bandwidth and Colocation Provided by http://www.api-digital.com -- Check out the new Asterisk community forum at: https://community.asterisk.org/ New to Asterisk? Start here: https://wiki.asterisk.org/wiki/display/AST/Getting+Started asterisk-users mailing list To UNSUBSCRIBE or update options visit: http://lists.digium.com/mailman/listinfo/asterisk-users
[asterisk-users] Asterisk 13.18.3, 14.7.3, 15.1.3 and Certified Asterisk 13.13-cert8 Now Available
The Asterisk Development Team has announced security releases for Certified Asterisk 13.13 and Asterisk 13, 14 and 15. The available security releases are released as versions 13.13-cert8, 13.18.3, 14.7.3 and 15.1.3. These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases The release of these versions resolves the following security vulnerabilities: * AST-2017-013: DOS Vulnerability in Asterisk chan_skinny If the chan_skinny (AKA SCCP protocol) channel driver is flooded with certain requests it can cause the asterisk process to use excessive amounts of virtual memory eventually causing asterisk to stop processing requests of any kind. For a full list of changes in the current releases, please see the ChangeLogs: http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.18.3 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog=14.7.3 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-15.1.3 http://downloads.asterisk.org/pub/telephony/certified-asterisk/ChangeLog-certified-13.13-cert8 The security advisories are available at: http://downloads.asterisk.org/pub/security/AST-2017-013.pdf Thank you for your continued support of Asterisk! -- _ -- Bandwidth and Colocation Provided by http://www.api-digital.com -- Check out the new Asterisk community forum at: https://community.asterisk.org/ New to Asterisk? Start here: https://wiki.asterisk.org/wiki/display/AST/Getting+Started asterisk-users mailing list To UNSUBSCRIBE or update options visit: http://lists.digium.com/mailman/listinfo/asterisk-users
[asterisk-users] MOH on demand?
Hello! I'm currently using Asterisk 11 (due to the fact that Debian Wheezy has Ast 11 in backports - so that I can have security updates from my distribution). I recently played a little with Asterisk to be able to hear internet-radios over the local phones in my home. So I set up a couple of music-on-hold classes to be able to "stream" the radios through Asterisk to the phone(s). I use the "custom" MOH type. I noticed however that asterisk downloads all of the streams the whole time even there is no channel in use which would be using those moh-streams. So my question is: Does Asterisk (maybe in version > 11) allow to have on-demand MOH "custom" streams, i.e. in a way that Asterisk would start an external binary to fetch the stream only when needed - and when not needed the binary would then be killed (using -HUP e.g.). (Please, note that I'm NOT using internet radios for a real MOH - I'm just using the MOH mechanism to play the radio over the phone so _legally_ it is not different from playing internet-radios using any other client.) Thanks! -- _ -- Bandwidth and Colocation Provided by http://www.api-digital.com -- Check out the new Asterisk community forum at: https://community.asterisk.org/ New to Asterisk? Start here: https://wiki.asterisk.org/wiki/display/AST/Getting+Started asterisk-users mailing list To UNSUBSCRIBE or update options visit: http://lists.digium.com/mailman/listinfo/asterisk-users
