exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Asterisk Project Security Advisory - AST-2014-005

Asterisk Project Security Advisory - AST-2014-005
Posted Jun 13, 2014
Authored by John Bigelow, Kevin Harwell | Site asterisk.org

Asterisk Project Security Advisory - A remotely exploitable crash vulnerability exists in the PJSIP channel driver's pub/sub framework. If an attempt is made to unsubscribe when not currently subscribed and the endpoint's "sub_min_expiry" is set to zero, Asterisk tries to create an expiration timer with zero seconds, which is not allowed, so an assertion raised.

tags | advisory
advisories | CVE-2014-4045
SHA-256 | 6b85765fc735a00c686484dac76731431461bf16a925d2e52ab0d28b8d4331fe

Asterisk Project Security Advisory - AST-2014-005

Change Mirror Download
               Asterisk Project Security Advisory - AST-2014-005

Product Asterisk
Summary Remote Crash in PJSIP Channel Driver's
Publish/Subscribe Framework
Nature of Advisory Denial of Service
Susceptibility Remote Unauthenticated Sessions
Severity Moderate
Exploits Known No
Reported On March 17, 2014
Reported By John Bigelow <jbigelow AT digium DOT com>
Posted On June 12, 2014
Last Updated On June 12, 2014
Advisory Contact Kevin Harwell <kharwell AT digium DOT com>
CVE Name CVE-2014-4045

Description A remotely exploitable crash vulnerability exists in the
PJSIP channel driver's pub/sub framework. If an attempt is
made to unsubscribe when not currently subscribed and the
endpoint's "sub_min_expiry" is set to zero, Asterisk tries
to create an expiration timer with zero seconds, which is
not allowed, so an assertion raised.

Resolution Upgrade to a version with the patch integrated, apply the
patch, or make sure the "sub_min_expiry" endpoint
configuration option is greater than zero.

Affected Versions
Product Release Series
Asterisk Open Source 12.x All

Corrected In
Product Release
Asterisk Open Source 12.x 12.3.1

Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2014-005-12.diff Asterisk
12

Links https://issues.asterisk.org/jira/browse/ASTERISK-23489

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2014-005.pdf and
http://downloads.digium.com/pub/security/AST-2014-005.html

Revision History
Date Editor Revisions Made
April 14, 2014 Kevin Harwell Document Creation
June 12, 2014 Matt Jordan Added CVE

Asterisk Project Security Advisory - AST-2014-005
Copyright (c) 2014 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close