BugTraq
AST-2016-008: Crash on SDP offer or answer from endpoint using Opus Dec 08 2016 10:24PM
Asterisk Security Team (security asterisk org)
Asterisk Project Security Advisory - AST-2016-008

Product Asterisk
Summary Crash on SDP offer or answer from endpoint using
Opus
Nature of Advisory Remote Crash
Susceptibility Remote unauthenticated sessions
Severity Critical
Exploits Known No
Reported On November 11, 2016
Reported By jorgen
Posted On
Last Updated On November 15, 2016
Advisory Contact jcolp AT digium DOT com
CVE Name

Description If an SDP offer or answer is received with the Opus codec
and with the format parameters separated using a space the
code responsible for parsing will recursively call itself
until it crashes. This occurs as the code does not properly
handle spaces separating the parameters. This does NOT
require the endpoint to have Opus configured in Asterisk.
This also does not require the endpoint to be
authenticated. If guest is enabled for chan_sip or
anonymous in chan_pjsip an SDP offer or answer is still
processed and the crash occurs.

Resolution The code has been updated to properly handle spaces
separating parameters in the fmtp line. Upgrade to a
released version with the fix incorporated or apply patch.

Affected Versions
Product Release
Series
Asterisk Open Source 13.x 13.12.0 and higher
Asterisk Open Source 14.x All Versions

Corrected In
Product Release
Asterisk Open Source 13.13.1, 14.2.1

Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2016-008-13.diff Asterisk
13
http://downloads.asterisk.org/pub/security/AST-2016-008-14.diff Asterisk
14

Links https://issues.asterisk.org/jira/browse/ASTERISK-26579

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2016-008.pdf and
http://downloads.digium.com/pub/security/AST-2016-008.html

Revision History
Date Editor Revisions Made
November 15, 2016 Joshua Colp Initial draft of Advisory

Asterisk Project Security Advisory - AST-2016-008
Copyright © 2016 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus