Digium Zaptel Multiple Local Privilege Escalation and Denial of Service Vulnerabilities

Bugtraq ID:	32575
Class:	Input Validation Error
CVE:	CVE-2008-5396 CVE-2008-5744
Remote:	No
Local:	Yes
Published:	Nov 25 2008 12:00AM
Updated:	Nov 16 2010 09:50PM
Credit:	Tzafrir Cohen
Vulnerable:	Gentoo Linux Digium Zaptel 1.4 Digium Zaptel 1.2 Digium DAHDI 2.1 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:

Digium Zaptel Multiple Local Privilege Escalation and Denial of Service Vulnerabilities

Digium Zaptel is prone to multiple local privilege-escalation and denial-of-service vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Attackers can exploit these issues to gain elevated privileges or cause a denial-of-service condition on a system using the vulnerable driver.

UPDATE (December 19, 2008): Patched versions remain vulnerable to this issue. Updated fixes are now available.

Digium Zaptel 1.2 and 1.4 are vulnerable.

Digium Zaptel Multiple Local Privilege Escalation and Denial of Service Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Digium Zaptel Multiple Local Privilege Escalation and Denial of Service Vulnerabilities

Solution:
The vendor has released an advisory and fixes. Please see the references for more information.

UPDATE (December 19, 2008): Patched versions remain vulnerable to this issue. Updated fixes are now available.


Debian Linux 4.0 amd64

• Debian zaptel_1.2.11.dfsg-1+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.df sg-1+etch1_amd64.deb


• Debian zaptel-source_1.2.11.dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel-source_1. 2.11.dfsg-1+etch1_all.deb


• Debian libtonezone1_1.2.11.dfsg-1+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2 .11.dfsg-1+etch1_amd64.deb


• Debian libtonezone-dev_1.2.11.dfsg-1+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_ 1.2.11.dfsg-1+etch1_amd64.deb

Debian Linux 4.0 ia-32

• Debian zaptel_1.2.11.dfsg-1+etch1_i386.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.df sg-1+etch1_i386.deb


• Debian zaptel-source_1.2.11.dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel-source_1. 2.11.dfsg-1+etch1_all.deb


• Debian libtonezone-dev_1.2.11.dfsg-1+etch1_i386.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_ 1.2.11.dfsg-1+etch1_i386.deb


• Debian libtonezone1_1.2.11.dfsg-1+etch1_i386.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2 .11.dfsg-1+etch1_i386.deb

Debian Linux 4.0 arm

• Debian libtonezone1_1.2.11.dfsg-1+etch1_arm.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2 .11.dfsg-1+etch1_arm.deb


• Debian libtonezone-dev_1.2.11.dfsg-1+etch1_arm.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_ 1.2.11.dfsg-1+etch1_arm.deb


• Debian zaptel-source_1.2.11.dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel-source_1. 2.11.dfsg-1+etch1_all.deb


• Debian zaptel_1.2.11.dfsg-1+etch1_arm.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.df sg-1+etch1_arm.deb

Debian Linux 4.0 hppa

• Debian zaptel-source_1.2.11.dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel-source_1. 2.11.dfsg-1+etch1_all.deb

Debian Linux 4.0 sparc

• Debian zaptel_1.2.11.dfsg-1+etch1_sparc.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.df sg-1+etch1_sparc.deb


• Debian zaptel-source_1.2.11.dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel-source_1. 2.11.dfsg-1+etch1_all.deb


• Debian libtonezone-dev_1.2.11.dfsg-1+etch1_sparc.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_ 1.2.11.dfsg-1+etch1_sparc.deb


• Debian libtonezone1_1.2.11.dfsg-1+etch1_sparc.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2 .11.dfsg-1+etch1_sparc.deb

Debian Linux 4.0 s/390

• Debian zaptel-source_1.2.11.dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel-source_1. 2.11.dfsg-1+etch1_all.deb


• Debian libtonezone1_1.2.11.dfsg-1+etch1_s390.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2 .11.dfsg-1+etch1_s390.deb


• Debian zaptel_1.2.11.dfsg-1+etch1_s390.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.df sg-1+etch1_s390.deb


• Debian libtonezone-dev_1.2.11.dfsg-1+etch1_s390.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_ 1.2.11.dfsg-1+etch1_s390.deb

Debian Linux 4.0 powerpc

• Debian zaptel_1.2.11.dfsg-1+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.df sg-1+etch1_powerpc.deb


• Debian libtonezone-dev_1.2.11.dfsg-1+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_ 1.2.11.dfsg-1+etch1_powerpc.deb


• Debian zaptel-source_1.2.11.dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel-source_1. 2.11.dfsg-1+etch1_all.deb


• Debian libtonezone1_1.2.11.dfsg-1+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2 .11.dfsg-1+etch1_powerpc.deb

Debian Linux 4.0 alpha

• Debian zaptel_1.2.11.dfsg-1+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.df sg-1+etch1_alpha.deb


• Debian zaptel-source_1.2.11.dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel-source_1. 2.11.dfsg-1+etch1_all.deb


• Debian libtonezone-dev_1.2.11.dfsg-1+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_ 1.2.11.dfsg-1+etch1_alpha.deb


• Debian libtonezone1_1.2.11.dfsg-1+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2 .11.dfsg-1+etch1_alpha.deb

Debian Linux 4.0 m68k

• Debian zaptel-source_1.2.11.dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel-source_1. 2.11.dfsg-1+etch1_all.deb

Debian Linux 4.0

• Debian zaptel-source_1.2.11.dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel-source_1. 2.11.dfsg-1+etch1_all.deb

Debian Linux 4.0 mipsel

• Debian zaptel-source_1.2.11.dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel-source_1. 2.11.dfsg-1+etch1_all.deb

Debian Linux 4.0 ia-64

• Debian zaptel_1.2.11.dfsg-1+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.df sg-1+etch1_ia64.deb


• Debian libtonezone1_1.2.11.dfsg-1+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2 .11.dfsg-1+etch1_ia64.deb


• Debian libtonezone-dev_1.2.11.dfsg-1+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_ 1.2.11.dfsg-1+etch1_ia64.deb


• Debian zaptel-source_1.2.11.dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel-source_1. 2.11.dfsg-1+etch1_all.deb

Debian Linux 4.0 mips

• Debian libtonezone1_1.2.11.dfsg-1+etch1_mips.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2 .11.dfsg-1+etch1_mips.deb


• Debian libtonezone-dev_1.2.11.dfsg-1+etch1_mips.deb
  http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_ 1.2.11.dfsg-1+etch1_mips.deb


• Debian zaptel-source_1.2.11.dfsg-1+etch1_all.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel-source_1. 2.11.dfsg-1+etch1_all.deb


• Debian zaptel_1.2.11.dfsg-1+etch1_mips.deb
  http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.df sg-1+etch1_mips.deb

Digium Zaptel Multiple Local Privilege Escalation and Denial of Service Vulnerabilities

References:

• 0013954: [patch] incoherent handling of span timing and lack of input validat (Digium)
  
• CVE Request - Incomplete dahdi/zaptel tor2.c patch for CVE-2008-5396 (Jan Lieskovsky)
  
• Digium Homepage (Digium)
  
• Revision 4587 (Digium)
  
• Revision 4588 (Digium)
  
• Revision 5590 (tzafrir)
  
• zaptel: insufficient input validation in some zaptel drivers (Digium)