BID:24950

Asterisk Multiple Remote Denial of Service Vulnerabilities

Info

Asterisk Multiple Remote Denial of Service Vulnerabilities

Bugtraq ID:	24950
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2007-3763 CVE-2007-3764 CVE-2007-3765 CVE-2007-4103
Remote:	Yes
Local:	No
Published:	Jul 18 2007 12:00AM
Updated:	Feb 26 2008 11:22PM
Credit:	Will Drewry, Chris Clark and Zane Lackey are credited with the discovery of these vulnerabilities.
Vulnerable:	SuSE Linux 10.1 x86-64 SuSE Linux 10.1 x86 SuSE Linux 10.1 ppc SuSE Linux 10.0 x86-64 SuSE Linux 10.0 x86 SuSE Linux 10.0 ppc S.u.S.E. openSUSE 10.2 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 10.1 Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Asterisk s800i Appliance 1.0.1 Asterisk s800i Appliance 1.0 Asterisk AsteriskNow Beta 6 Asterisk AsteriskNow Beta 5 Asterisk Asterisk Business Edition B.2.2.0 Asterisk Asterisk Business Edition B.1.3.3 Asterisk Asterisk Business Edition B.1.3.2 Asterisk Asterisk Business Edition A Asterisk Asterisk Appliance Developer Kit 0.4 Asterisk Asterisk 1.4.7 Asterisk Asterisk 1.4.4 Asterisk Asterisk 1.4.3 Asterisk Asterisk 1.4.2 Asterisk Asterisk 1.4.1 Asterisk Asterisk 1.2.21 Asterisk Asterisk 1.2.19 Asterisk Asterisk 1.2.18 Asterisk Asterisk 1.2.17 Asterisk Asterisk 1.2.16 Asterisk Asterisk 1.2.15 Asterisk Asterisk 1.2.14 Asterisk Asterisk 1.2.13 Asterisk Asterisk 1.2.11 Asterisk Asterisk 1.2.11 Asterisk Asterisk 1.2.10 Asterisk Asterisk 1.2 .0-beta2 Asterisk Asterisk 1.2 .0-beta1 Asterisk Asterisk 1.0.12 Asterisk Asterisk 1.0.11 Asterisk Asterisk 1.0.10 Asterisk Asterisk 1.0.9 Asterisk Asterisk 1.0.8 Asterisk Asterisk 1.0.7 Asterisk Asterisk 1.0.6 Asterisk Asterisk 1.0 Asterisk Asterisk B.2.1 Asterisk Asterisk 1.4 Beta Asterisk Appliance Developers Kit 0.3

Not Vulnerable:	Asterisk s800i Appliance 1.0.2 Asterisk AsteriskNow Beta 7 Asterisk Asterisk Business Edition B.2.2.1 Asterisk Asterisk Appliance Developer Kit 0.5 Asterisk Asterisk 1.4.8 Asterisk Asterisk 1.2.22

Discussion

Asterisk Multiple Remote Denial of Service Vulnerabilities

Asterisk is prone to multiple remote denial-of-service vulnerabilities.

Exploiting these issues allows remote attackers to cause the application to crash, effectively denying service to legitimate users.

Exploit / POC

Asterisk Multiple Remote Denial of Service Vulnerabilities

To exploit these issues, attackers may use readily available network utilities.

The following exploit is available:

/data/vulnerabilities/exploits/24950.rb

Solution / Fix

Asterisk Multiple Remote Denial of Service Vulnerabilities

Solution:
The vendor has released fixes to address these issues. Please see the references for information on obtaining and installing these fixes.

Asterisk Asterisk 1.4 Beta