Asterisk Chan_Skinny Remote Buffer Overflow Vulnerability

Bugtraq ID:	20617
Class:	Boundary Condition Error
CVE:	CVE-2006-5444
Remote:	Yes
Local:	No
Published:	Oct 18 2006 12:00AM
Updated:	Jan 15 2007 11:10PM
Credit:	Adam Boileau is credited with discovering this issue.
Vulnerable:	S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 10.1 OpenPKG OpenPKG 2.5 OpenPKG OpenPKG 2.4 OpenPKG OpenPKG 2.3 OpenPKG OpenPKG 2.2 OpenPKG OpenPKG 2.1 OpenPKG OpenPKG 2.0 OpenPKG OpenPKG Stable Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Asterisk Asterisk 1.2.11 Asterisk Asterisk 1.2.11 Asterisk Asterisk 1.2.10 Asterisk Asterisk 1.2.9 Asterisk Asterisk 1.2.8 Asterisk Asterisk 1.2.7 Asterisk Asterisk 1.2.6 Asterisk Asterisk 1.2.5 Asterisk Asterisk 1.2 .0-beta2 Asterisk Asterisk 1.2 .0-beta1 Asterisk Asterisk 1.0.11 Asterisk Asterisk 1.0.10 Asterisk Asterisk 1.0.9 Asterisk Asterisk 1.0.8 Asterisk Asterisk 1.0.7 Asterisk Asterisk 1.0.6 Asterisk Asterisk 1.0 Asterisk Asterisk 0.9 .0 Asterisk Asterisk 0.7.2 Asterisk Asterisk 0.7.1 Asterisk Asterisk 0.7 .0 Asterisk Asterisk 0.4 Asterisk Asterisk 0.3 Asterisk Asterisk 0.2 Asterisk Asterisk 0.1.9 -1 Asterisk Asterisk 0.1.9 Asterisk Asterisk 0.1.8 Asterisk Asterisk 0.1.7
Not Vulnerable:	Asterisk Asterisk 1.2.13 Asterisk Asterisk 1.0.12 Asterisk Asterisk 1.4 Beta

Asterisk Chan_Skinny Remote Buffer Overflow Vulnerability

Asterisk is prone to a remote heap-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

Exploiting this vulnerability allows remote attackers to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely crash the server, denying further service to legitimate users.

Asterisk Chan_Skinny Remote Buffer Overflow Vulnerability

The following proof of concept is available:

• /data/vulnerabilities/exploits/20617.pl

Asterisk Chan_Skinny Remote Buffer Overflow Vulnerability

Solution:
To address this issue, the vendor has released versions 1.0.12 (for the 1.0.x strain) and 1.2.13 (for the 1.2.x strain).

Please see the references for more information.


Asterisk Asterisk 1.0.10

• Asterisk asterisk-1.0.11.tar.gz
  http://ftp.digium.com/pub/telephony/asterisk/releases/asterisk-1.0.11. tar.gz

Asterisk Asterisk 1.0.6

• SuSE asterisk-1.0.6-4.6.i586.rpm
  SUSE LINUX 9.3:
  ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/asterisk-1.0.6-4. 6.i586.rpm


• SuSE asterisk-1.0.6-4.6.x86_64.rpm
  SUSE LINUX 9.3:
  ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/asterisk-1.0.6- 4.6.x86_64.rpm

Asterisk Asterisk 1.0.7

• Asterisk asterisk-1.0.11.tar.gz
  http://ftp.digium.com/pub/telephony/asterisk/releases/asterisk-1.0.11. tar.gz


• Debian asterisk-config_1.0.7.dfsg.1-2sarge4_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.0.7.dfsg.1-2sarge4_all.deb


• Debian asterisk-dev_1.0.7.dfsg.1-2sarge4_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .0.7.dfsg.1-2sarge4_all.deb


• Debian asterisk-doc_1.0.7.dfsg.1-2sarge4_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .0.7.dfsg.1-2sarge4_all.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_alpha.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_amd64.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_arm.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_hppa.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_i386.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_ia64.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_m68k.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_mips.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_mipsel.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_powerpc.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_s390.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_sparc.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_alpha.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_amd64.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_arm.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_hppa.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_i386.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_ia64.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_m68k.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_mips.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_mipsel.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_powerpc.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_s390.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_sparc.deb


• Debian asterisk-sounds-main_1.0.7.dfsg.1-2sarge4_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.0.7.dfsg.1-2sarge4_all.deb


• Debian asterisk-web-vmail_1.0.7.dfsg.1-2sarge4_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-web-v mail_1.0.7.dfsg.1-2sarge4_all.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_alpha.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_amd64.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_arm.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_hppa.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_i386.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_ia64.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_m68k.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_mips.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_mipsel.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_powerpc.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_s390.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_sparc.deb

Asterisk Asterisk 1.0.8

• Asterisk asterisk-1.0.11.tar.gz
  http://ftp.digium.com/pub/telephony/asterisk/releases/asterisk-1.0.11. tar.gz

Asterisk Asterisk 1.0.9

• Asterisk asterisk-1.0.11.tar.gz
  http://ftp.digium.com/pub/telephony/asterisk/releases/asterisk-1.0.11. tar.gz


• SuSE asterisk-1.0.9-4.6.i586.rpm
  SUSE LINUX 10.0:
  ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/asterisk-1.0.9-4 .6.i586.rpm


• SuSE asterisk-1.0.9-4.6.ppc.rpm
  SUSE LINUX 10.0:
  ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/asterisk-1.0.9-4. 6.ppc.rpm


• SuSE asterisk-1.0.9-4.6.x86_64.rpm
  SUSE LINUX 10.0:
  ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/asterisk-1.0.9 -4.6.x86_64.rpm

Asterisk Asterisk 1.2 .0-beta1

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2 .0-beta2

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2.10

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2.11

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2.11

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2.5

• SuSE asterisk-1.2.5-12.8.i586.rpm
  SUSE LINUX 10.1:
  ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/asterisk-1.2.5-12.8.i 586.rpm


• SuSE asterisk-1.2.5-12.8.ppc.rpm
  SUSE LINUX 10.1:
  ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/asterisk-1.2.5-12.8.pp c.rpm


• SuSE asterisk-1.2.5-12.8.x86_64.rpm
  SUSE LINUX 10.1:
  ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/asterisk-1.2.5-12.8 .x86_64.rpm

Asterisk Asterisk 1.2.6

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2.7

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2.8

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2.9

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Chan_Skinny Remote Buffer Overflow Vulnerability

References:

• Asterisk Homepage (Asterisk)
  
• Security-Assessment.com Advisory: Asterisk remote heap overflow (Adam Boileau)