Asterisk Project Security Advisory - AST-2017-001 Product Asterisk Summary Buffer overflow in CDR's set user Nature of Advisory Buffer Overflow Susceptibility Remote Authenticated Sessions Severity Moderate Exploits Known No Reported On March 27, 2017 Reported By Alex Villacis Lasso Posted On Last Updated On April 4, 2017 Advisory Contact kharwell AT digium DOT com CVE Name Description No size checking is done when setting the user field on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. This allows the possibility of remote code injection. This currently affects any system using CDR's that also make use of the following: * The 'X-ClientCode' header within a SIP INFO message when using chan_sip and the 'useclientcode' option is enabled (note, it's disabled by default). * The CDR dialplan function executed from AMI when setting the user field. * The AMI Monitor action when using a long file name/path. Resolution The CDR engine now only copies up to the maximum allowed characters into the user field. Any characters outside the maximum are truncated. Affected Versions Product Release Series Asterisk Open Source 13.x All Releases Asterisk Open Source 14.x All Releases Certified Asterisk 13.13 All Releases Corrected In Product Release Asterisk Open Source 13.14.1,14.3.1 Certified Asterisk 13.13-cert3 Patches SVN URL Revision http://downloads.asterisk.org/pub/security/AST-2017-001-13.diff Asterisk 13 http://downloads.asterisk.org/pub/security/AST-2017-001-14.diff Asterisk 14 http://downloads.asterisk.org/pub/security/AST-2017-001-13.13.diff Certified Asterisk 13.13 Links https://issues.asterisk.org/jira/browse/ASTERISK-26897 Asterisk Project Security Advisories are posted at http://www.asterisk.org/security This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2017-001.pdf and http://downloads.digium.com/pub/security/AST-2017-001.html Revision History Date Editor Revisions Made March, 27, 2017 Kevin Harwell Initial Revision Asterisk Project Security Advisory - AST-2017-001 Copyright Â© 2017 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form.