ASTERWEB Blog

22Apr/16Off

Rilasciato Asterisk 13.8.2

Il giorno 20 aprile 2016, il Team di Sviluppo di Asterisk ha annunciato il rilascio di Asterisk 13.8.2.

Dal post originale:

The release of Asterisk 13.8.2 resolves several issues reported by the community and would have not been possible without your participation.
Thank you!

The following are the issues resolved in this release:

Bugs fixed in this release:
-----------------------------------
* ASTERISK-25929 - res_pjsip_registrar: AOR_CONTACT_ADDED events not raised (Reported by Joshua Colp)
* ASTERISK-25928 - res_pjsip: URI validation done outside of PJSIP thread (Reported by Joshua Colp)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-13.8.2

15Apr/16Off

AST-2016-005: TCP denial of service in PJProject

               Asterisk Project Security Advisory - AST-2016-005

Product Asterisk
Summary TCP denial of service in PJProject
Nature of Advisory Crash/Denial of Service
Susceptibility Remote Unauthenticated Sessions
Severity Critical
Exploits Known No
Reported On February 15, 2016
Reported By George Joseph
Posted On
Last Updated On March 3, 2016
Advisory Contact Mark Michelson <mark DOT michelson AT digium DOT
com>
CVE Name

Description PJProject has a limit on the number of TCP connections that
it can accept. Furthermore, PJProject does not close TCP
connections it accepts. By default, this value is
approximately 60.

An attacker can deplete the number of allowed TCP
connections by opening TCP connections and sending no data
to Asterisk.

If PJProject has been compiled in debug mode, then once the
number of allowed TCP connections has been depleted, the
next attempted TCP connection to Asterisk will crash due to
an assertion in PJProject.

If PJProject has not been compiled in debug mode, then any
further TCP connection attempts will be rejected. This
makes Asterisk unable to process TCP SIP traffic.

Note that this only affects TCP/TLS, since UDP is
connectionless. Also note that this does not affect
chan_sip.

Resolution PJProject has a compile-time constant that controls the
maximum number of TCP connections that can be handled. Those
who compile PJProject on their own are encouraged to set
this to a value that is more amenable to the number of TCP
connections that Asterisk should be able to handle. In
PJProject's pjlib/include/pj/config_site.h, add the
following prior to compiling PJProject:

# define PJ_IOQUEUE_MAX_HANDLES (FD_SETSIZE)

This is part of a larger set of recommended definitions to
place in config_site.h of PJProject. See the Asterisk
"Building and Installing PJProject" wiki page for other
recommended settings.

Packagers of PJProject have updated their packages to have
these constants defined, so if your package is kept up to
date, you should already be fine.

In addition, the Asterisk project has recently been modified
to be able to perform a static build of PJProject. By
running the Asterisk configure script with the
--with-pjproject-bundled option, the latest PJProject will
be downloaded and installed, and the compile-time constants
will be set to appropriate values.

Asterisk has also been updated to monitor incoming TCP
connections. If a TCP connection is opened and no SIP
request is received on that connection within a certain
amount of time, then Asterisk will shut down the connection.

Affected Versions
Product Release
Series
Asterisk Open Source 13.x All Versions

Corrected In
Product Release
Asterisk Open Source 13.8.1
Certified Asterisk 13.1-cert5

Patches
SVN URL Revision

Links

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2016-005.pdf and
http://downloads.digium.com/pub/security/AST-2016-005.html

15Apr/16Off

AST-2016-004: Long Contact URIs in REGISTER requests can crash Asterisk

               Asterisk Project Security Advisory - AST-2016-004

Product Asterisk
Summary Long Contact URIs in REGISTER requests can crash
Asterisk
Nature of Advisory Remote Crash
Susceptibility Remote Authenticated Sessions
Severity Major
Exploits Known No
Reported On January 19, 2016
Reported By George Joseph
Posted On
Last Updated On February 10, 2016
Advisory Contact Mark Michelson <mmichelson AT digium DOT com>
CVE Name

Description Asterisk may crash when processing an incoming REGISTER
request if that REGISTER contains a Contact header with a
lengthy URI.

This crash will only happen for requests that pass
authentication. Unauthenticated REGISTER requests will not
result in a crash occurring.

This vulnerability only affects Asterisk when using PJSIP
as its SIP stack. The chan_sip module does not have this
problem.

Resolution Measures have been put in place to ensure that REGISTER
requests with long Contact URIs are rejected instead of
causing a crash.

Affected Versions
Product Release
Series
Asterisk Open Source 11.x Unaffected
Asterisk Open Source 13.x All versions
Certified Asterisk 11.6 Unaffected
Certified Asterisk 13.1 All versions

Corrected In
Product Release
Asterisk Open Source 13.8.1
Certified Asterisk 13.1-cert5

Patches
SVN URL Revision

Links

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2016-004.pdf and
http://downloads.digium.com/pub/security/AST-2016-004.html

2Apr/16Off

Rilasciato Kamailio versione 4.4.0

kamailio-logo-nuovo

Dopo molti mesi di sviluppo, il team di sviluppo Kamailio ha rilasciato la nuova versione 4.4.0 Kamailio.

CHANGELOG