Asterisk Pedantic Mode SIP Channel Driver INVITE Header Remote Denial of Service Vulnerability

Bugtraq ID:	34070
Class:	Design Error
CVE:	CVE-2009-0871
Remote:	Yes
Local:	No
Published:	Mar 10 2009 12:00AM
Updated:	Apr 13 2015 09:49PM
Credit:	klaus3000 and tecnoxarxa
Vulnerable:	Asterisk Asterisk Business Edition C.2.3 Asterisk Asterisk 1.6.1 0-rc1 Asterisk Asterisk 1.6 beta6 Asterisk Asterisk 1.4.23 .1 Asterisk Asterisk 1.4.23 Asterisk Asterisk 1.4.22 Asterisk Asterisk 1.6.0.3 Asterisk Asterisk 1.6
Not Vulnerable:	Asterisk Asterisk Business Edition C.2.3 .2 Asterisk Asterisk 1.6.1 0-rc2 Asterisk Asterisk 1.6 6 Asterisk Asterisk 1.4.23 .2

Asterisk Pedantic Mode SIP Channel Driver INVITE Header Remote Denial of Service Vulnerability

Asterisk is prone to a remote denial-of-service vulnerability because it fails to adequately validate INVITE headers in pedantic mode.

Successful exploits can crash the SIP channel driver, resulting in denial-of-service conditions for legitimate users.

Asterisk Pedantic Mode SIP Channel Driver INVITE Header Remote Denial of Service Vulnerability

Attackers can exploit this issue by using readily available networking utilities.

Asterisk Pedantic Mode SIP Channel Driver INVITE Header Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Asterisk Asterisk 1.6.0.3

• Asterisk AST-2009-002-1.6.0.diff
  http://downloads.digium.com/pub/security/AST-2009-002-1.6.0.diff

Asterisk Asterisk 1.6

• Asterisk AST-2009-002-1.6.0.diff
  http://downloads.digium.com/pub/security/AST-2009-002-1.6.0.diff

Asterisk Asterisk 1.4.22

• Asterisk AST-2009-002-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-002-1.4.diff

Asterisk Asterisk 1.4.23

• Asterisk AST-2009-002-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-002-1.4.diff

Asterisk Asterisk 1.4.23 .1

• Asterisk AST-2009-002-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-002-1.4.diff

Asterisk Asterisk 1.6 beta6

• Asterisk AST-2009-002-1.6.0.diff
  http://downloads.digium.com/pub/security/AST-2009-002-1.6.0.diff

Asterisk Asterisk 1.6.1 0-rc1

• Asterisk AST-2009-002-1.6.1.diff
  http://downloads.digium.com/pub/security/AST-2009-002-1.6.1.diff

Asterisk Pedantic Mode SIP Channel Driver INVITE Header Remote Denial of Service Vulnerability

References:

• Asterisk Homepage (Asterisk)
  
• AST-2009-002: Remote Crash Vulnerability in SIP channel driver ("Asterisk Security Team" )
  
• Asterisk Project Security Advisory - AST-2009-002 Product (Asterisk)