ASTERWEB Blog

13Giu/14Off

Asterisk Project Security Advisory – AST-2014-008

Il giorno 12 giugno 2014, il Team di Sviluppo di Asterisk ha annunciato il rilascio delle securety release per Asterisk: 1.8.15-cert6, 1.8.28.1, 11.6-cert3, 11.10.1, 12.3.1

Dal post originale:

Asterisk Project Security Advisory - AST-2014-008

Product Asterisk
Summary Denial of Service in PJSIP Channel Driver
Subscriptions
Nature of Advisory Denial of Service
Susceptibility Remote authenticated sessions
Severity Moderate
Exploits Known No
Reported On 28 May, 2014
Reported By Mark Michelson
Posted On June 12, 2014
Last Updated On June 12, 2014
Advisory Contact Mark Michelson
CVE Name CVE-2014-4048

Description When a SIP transaction timeout caused a subscription to be
terminated, the action taken by Asterisk was guaranteed to
deadlock the thread on which SIP requests are serviced.

Note that this behavior could only happen on established
subscriptions, meaning that this could only be exploited if
an attacker bypassed authentication and successfully
subscribed to a real resource on the Asterisk server.

Resolution The socket-servicing thread is now no longer capable of
dispatching synchronous tasks to other threads since that
may result in deadlocks.

Affected Versions
Product Release Series
Asterisk Open Source 12.x All versions

Corrected In
Product Release
Asterisk Open Source 12.3.1

Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2014-008-12.diff Asterisk
12

Links https://issues.asterisk.org/jira/browse/ASTERISK-23802

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2014-008.pdf and
http://downloads.digium.com/pub/security/AST-2014-008.html

13Giu/14Off

Asterisk Project Security Advisory – AST-2014-007

Il giorno 12 giugno 2014, il Team di Sviluppo di Asterisk ha annunciato il rilascio delle securety release per Asterisk: 1.8.15-cert6, 1.8.28.1, 11.6-cert3, 11.10.1, 12.3.1

Dal post originale:

Asterisk Project Security Advisory - AST-2014-007

Product Asterisk
Summary Exhaustion of Allowed Concurrent HTTP Connections
Nature of Advisory Denial Of Service
Susceptibility Remote Unauthenticated Sessions
Severity Moderate
Exploits Known No
Reported On May 25, 2014
Reported By Richard Mudgett
Posted On May 9, 2014
Last Updated On June 12, 2014
Advisory Contact Richard Mudgett
CVE Name CVE-2014-4047

Description Establishing a TCP or TLS connection to the configured HTTP
or HTTPS port respectively in http.conf and then not
sending or completing a HTTP request will tie up a HTTP
session. By doing this repeatedly until the maximum number
of open HTTP sessions is reached, legitimate requests are
blocked.

Resolution The patched versions now have a session_inactivity timeout
option in http.conf that defaults to 30000 ms. Users should
upgrade to a corrected version, apply the released patches,
or disable HTTP support.

Affected Versions
Product Release Series
Asterisk Open Source 1.8.x All versions
Asterisk Open Source 11.x All versions
Asterisk Open Source 12.x All versions
Certified Asterisk 1.8.15 All versions
Certified Asterisk 11.6 All versions

Corrected In
Product Release
Asterisk Open Source 1.8.28.1, 11.10.1, 12.3.1
Certified Asterisk 1.8.15-cert6, 11.6-cert3

Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2014-007-1.8.diff Asterisk
1.8
http://downloads.asterisk.org/pub/security/AST-2014-007-11.diff Asterisk
11
http://downloads.asterisk.org/pub/security/AST-2014-007-12.diff Asterisk
12
http://downloads.asterisk.org/pub/security/AST-2014-007-1.8.15.diff Certified
Asterisk
1.8.15
http://downloads.asterisk.org/pub/security/AST-2014-007-11.6.diff Certified
Asterisk
11.6

Links https://issues.asterisk.org/jira/browse/ASTERISK-23673

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2014-007.pdf and
http://downloads.digium.com/pub/security/AST-2014-007.html

13Giu/14Off

Asterisk Project Security Advisory – AST-2014-006

Il giorno 12 giugno 2014, il Team di Sviluppo di Asterisk ha annunciato il rilascio delle securety release per Asterisk: 1.8.15-cert6, 1.8.28.1, 11.6-cert3, 11.10.1, 12.3.1

Dal post originale:

Asterisk Project Security Advisory - AST-2014-006

Product Asterisk
Summary Asterisk Manager User Unauthorized Shell Access
Nature of Advisory Permission Escalation
Susceptibility Remote Authenticated Sessions
Severity Minor
Exploits Known No
Reported On April 9, 2014
Reported By Corey Farrell
Posted On June 12, 2014
Last Updated On June 12, 2014
Advisory Contact Jonathan Rose < jrose AT digium DOT com >
CVE Name CVE-2014-4046

Description Manager users can execute arbitrary shell commands with the
MixMonitor manager action. Asterisk does not require system
class authorization for a manager user to use the
MixMonitor action, so any manager user who is permitted to
use manager commands can potentially execute shell commands
as the user executing the Asterisk process.

Resolution Upgrade to a version with the patch integrated, apply the
patch, or do not allow users who should not have permission
to run shell commands to use AMI.

Affected Versions
Product Release Series
Asterisk Open Source 11.x All
Asterisk Open Source 12.x All
Certified Asterisk 11.6 All

Corrected In
Product Release
Asterisk Open Source 11.10.1, 12.3.1
Certified Asterisk 11.6-cert3

Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2014-006-11.diff Asterisk
11
http://downloads.asterisk.org/pub/security/AST-2014-006-12.diff Asterisk
12
http://downloads.asterisk.org/pub/security/AST-2014-006-11.6.diff Certified
Asterisk
11.6

Links https://issues.asterisk.org/jira/browse/ASTERISK-23609

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2014-006.pdf and
http://downloads.digium.com/pub/security/AST-2014-006.html

13Giu/14Off

Asterisk Project Security Advisory – AST-2014-005

Il giorno 12 giugno 2014, il Team di Sviluppo di Asterisk ha annunciato il rilascio delle securety release per Asterisk: 1.8.15-cert6, 1.8.28.1, 11.6-cert3, 11.10.1, 12.3.1

Dal post originale:

Asterisk Project Security Advisory - AST-2014-005

Product Asterisk
Summary Remote Crash in PJSIP Channel Driver's
Publish/Subscribe Framework
Nature of Advisory Denial of Service
Susceptibility Remote Unauthenticated Sessions
Severity Moderate
Exploits Known No
Reported On March 17, 2014
Reported By John Bigelow
Posted On June 12, 2014
Last Updated On June 12, 2014
Advisory Contact Kevin Harwell
CVE Name CVE-2014-4045

Description A remotely exploitable crash vulnerability exists in the
PJSIP channel driver's pub/sub framework. If an attempt is
made to unsubscribe when not currently subscribed and the
endpoint's "sub_min_expiry" is set to zero, Asterisk tries
to create an expiration timer with zero seconds, which is
not allowed, so an assertion raised.

Resolution Upgrade to a version with the patch integrated, apply the
patch, or make sure the "sub_min_expiry" endpoint
configuration option is greater than zero.

Affected Versions
Product Release Series
Asterisk Open Source 12.x All

Corrected In
Product Release
Asterisk Open Source 12.x 12.3.1

Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2014-005-12.diff Asterisk
12

Links https://issues.asterisk.org/jira/browse/ASTERISK-23489

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2014-005.pdf and
http://downloads.digium.com/pub/security/AST-2014-005.html

13Giu/14Off

Asterisk: Security Release 1.8.15-cert6, 1.8.28.1, 11.6-cert3, 11.10.1, 12.3.1

Il giorno 12 giugno 2014, il Team di Sviluppo di Asterisk ha annunciato il rilascio delle securety release per Asterisk: 1.8.15-cert6, 1.8.28.1, 11.6-cert3, 11.10.1, 12.3.1

Dal post originale:
The release of these versions resolves the following issue:

* AST-2014-007: Denial of Service via Exhaustion of Allowed Concurrent HTTP
Connections

Establishing a TCP or TLS connection to the configured HTTP or HTTPS port
respectively in http.conf and then not sending or completing a HTTP request
will tie up a HTTP session. By doing this repeatedly until the maximum number
of open HTTP sessions is reached, legitimate requests are blocked.

Additionally, the release of 11.6-cert3, 11.10.1, and 12.3.1 resolves the
following issue:

* AST-2014-006: Permission Escalation via Asterisk Manager User Unauthorized
Shell Access

Manager users can execute arbitrary shell commands with the MixMonitor manager
action. Asterisk does not require system class authorization for a manager
user to use the MixMonitor action, so any manager user who is permitted to use
manager commands can potentially execute shell commands as the user executing
the Asterisk process.

Additionally, the release of 12.3.1 resolves the following issues:

* AST-2014-005: Remote Crash in PJSIP Channel Driver's Publish/Subscribe
Framework

A remotely exploitable crash vulnerability exists in the PJSIP channel
driver's pub/sub framework. If an attempt is made to unsubscribe when not
currently subscribed and the endpoint's “sub_min_expiry” is set to zero,
Asterisk tries to create an expiration timer with zero seconds, which is not
allowed, so an assertion raised.

* AST-2014-008: Denial of Service in PJSIP Channel Driver Subscriptions

When a SIP transaction timeout caused a subscription to be terminated, the
action taken by Asterisk was guaranteed to deadlock the thread on which SIP
requests are serviced. Note that this behavior could only happen on
established subscriptions, meaning that this could only be exploited if an
attacker bypassed authentication and successfully subscribed to a real
resource on the Asterisk server.

These issues and their resolutions are described in the security advisories.

For more information about the details of these vulnerabilities, please read
security advisories AST-2014-005, AST-2014-006, AST-2014-007, and AST-2014-008,
which were released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLogs:

http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-1.8.15-cert6
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.28.1
http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-11.6-cert3
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.10.1
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-12.3.1

3Giu/14Off

Asterweb: Corso Configurazione Patton Smartnode

Questa la newsletter con cui abbiamo comunicato ai nostri iscritti, Partners e Rivenditori l'organizzazione di questo corso, ad un costo estremamente contenuto (solo 65,00 Euro più iva), che siamo certi aiuterà tutti gli operatori del settore che parteciperanno.

 

Corso: Configurazione Patton Smartnode

Corso OnLine: Configurazione Patton Smartnode

Costo: 65,00 + iva

PRENOTA SUBITO

Omaggio:
file configurazione per i modelli:

4120/1BIS2V, 4120/2BIS4V, 4112/JO, 4114/JO, 4940/1E30V, 4961/1E30V

Potrai finalmente configurarteli da solo!


Unica data (esclusiva) - prenota immediatamente!

Lunedì 16 giugno  dalle 14:00 alle 18:00

 

Corso: € 65,00 + iva Corso + 1 ora di assistenza: € 95,00 + iva







Programma

14:00 - 15:55

Inizio lavori

Panoramica prodotti

Interfaccia CLI

Esempi di configurazione

16:05 - 18:00

Context Switch

IP Context

SIP Gateways and SIP Servers

Debugging


Asterweb

Lo STaff

http://www.asterweb.org

http://www.asterisk-phonebook.com

Visitate il sito CLASS da dove potrete scricare le VM con già installato il software in versione FULL Demo.

Video Class:


2Giu/14Off

Terza sessione del FreeWebinar “Programmazione Asterisk per FreePBX/Elastix”

Questa la newsletter con la quale comunichiamo ai nostri iscritti, Partners e Rivenditori la data della terza sessione del FreeWebinar "Programmazione Asterisk per FreePBX/Elastix".

 

Webinar gratuito: Programmazione Asterisk per FreePBX/Elastix

Prosegue questo venerdì 6 giugno il programma di Webinar gratuiti organizzati da Asterweb che ha l'obiettivo di farvi acquisire le conoscenze per la programmazione di Asterisk (specificamente rivolta all'integrazione con FreePBX/Elastix).

Anche questo terzo Webinar, della durata di 1 ora, avrà inizio alle ore 14:30.

Per l'inscrizione inviare e-mail a: freewebinar@asterweb.org indicando il/i nominativo/i del/i partecipante/i.

Gli utenti già iscritti potranno partecipare direttamente accedendo con le credenziali precedentemente comunicate (senza nuova iscrizione).

Con l'auspicio di avervi numerosi, vi salutiamo cordialmente.

Asterweb

Lo STaff

http://www.asterweb.org

http://www.asterisk-phonebook.com

Visitate il sito CLASS da dove potrete scricare le VM con già installato il software in versione FULL Demo.

Video Class: