ASTERWEB Blog

23Dic/17Off

Rilasciati Asterisk 13.18.5, 14.7.5, 15.1.5 and 13.18-cert2 (Security)

The Asterisk Development Team would like to announce security releases for Asterisk 13, 14 and 15, and Certified Asterisk 13.18. The available releases are released as versions 13.18.5, 4.7.5, 15.1.5 and 13.18-cert2.

These releases are available for immediate download at
https://downloads.asterisk.org/pub/telephony/asterisk/releases
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases

The following security vulnerabilities were resolved in these versions:

* AST-2017-014: Crash in PJSIP resource when missing a contact header
A select set of SIP messages create a dialog in Asterisk. Those SIP messages
must contain a contact header. For those messages, if the header was not
present and using the PJSIP channel driver, it would cause Asterisk to crash.
The severity of this vulnerability is somewhat mitigated if authentication is
enabled. If authentication is enabled a user would have to first be authorized
before reaching the crash point.

For a full list of changes in the current releases, please see the ChangeLogs:

https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.18.5
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-14.7.5
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-15.1.5
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-13.18-cert2

The security advisory is available at:

https://downloads.asterisk.org/pub/security/AST-2017-014.pdf

Commenti (0) Trackback (0)

Spiacenti, il modulo dei commenti è chiuso per ora.

Ancora nessun trackback.