• info
• discussion
• exploit
• solution
• references

Asterisk Chan_Skinny Remote Buffer Overflow Vulnerability

Solution:
To address this issue, the vendor has released versions 1.0.12 (for the 1.0.x strain) and 1.2.13 (for the 1.2.x strain).

Please see the references for more information.


Asterisk Asterisk 1.0.10

• Asterisk asterisk-1.0.11.tar.gz
  http://ftp.digium.com/pub/telephony/asterisk/releases/asterisk-1.0.11. tar.gz

Asterisk Asterisk 1.0.6

• SuSE asterisk-1.0.6-4.6.i586.rpm
  SUSE LINUX 9.3:
  ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/asterisk-1.0.6-4. 6.i586.rpm


• SuSE asterisk-1.0.6-4.6.x86_64.rpm
  SUSE LINUX 9.3:
  ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/asterisk-1.0.6- 4.6.x86_64.rpm

Asterisk Asterisk 1.0.7

• Asterisk asterisk-1.0.11.tar.gz
  http://ftp.digium.com/pub/telephony/asterisk/releases/asterisk-1.0.11. tar.gz


• Debian asterisk-config_1.0.7.dfsg.1-2sarge4_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.0.7.dfsg.1-2sarge4_all.deb


• Debian asterisk-dev_1.0.7.dfsg.1-2sarge4_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .0.7.dfsg.1-2sarge4_all.deb


• Debian asterisk-doc_1.0.7.dfsg.1-2sarge4_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .0.7.dfsg.1-2sarge4_all.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_alpha.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_amd64.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_arm.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_hppa.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_i386.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_ia64.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_m68k.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_mips.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_mipsel.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_powerpc.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_s390.deb


• Debian asterisk-gtk-console_1.0.7.dfsg.1-2sarge4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-gtk-c onsole_1.0.7.dfsg.1-2sarge4_sparc.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_alpha.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_amd64.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_arm.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_hppa.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_i386.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_ia64.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_m68k.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_mips.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_mipsel.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_powerpc.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_s390.deb


• Debian asterisk-h323_1.0.7.dfsg.1-2sarge4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.0.7.dfsg.1-2sarge4_sparc.deb


• Debian asterisk-sounds-main_1.0.7.dfsg.1-2sarge4_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.0.7.dfsg.1-2sarge4_all.deb


• Debian asterisk-web-vmail_1.0.7.dfsg.1-2sarge4_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-web-v mail_1.0.7.dfsg.1-2sarge4_all.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_alpha.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_amd64.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_arm.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_hppa.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_i386.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_ia64.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_m68k.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_mips.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_mipsel.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_powerpc.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_s390.deb


• Debian asterisk_1.0.7.dfsg.1-2sarge4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.0.7 .dfsg.1-2sarge4_sparc.deb

Asterisk Asterisk 1.0.8

• Asterisk asterisk-1.0.11.tar.gz
  http://ftp.digium.com/pub/telephony/asterisk/releases/asterisk-1.0.11. tar.gz

Asterisk Asterisk 1.0.9

• Asterisk asterisk-1.0.11.tar.gz
  http://ftp.digium.com/pub/telephony/asterisk/releases/asterisk-1.0.11. tar.gz


• SuSE asterisk-1.0.9-4.6.i586.rpm
  SUSE LINUX 10.0:
  ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/asterisk-1.0.9-4 .6.i586.rpm


• SuSE asterisk-1.0.9-4.6.ppc.rpm
  SUSE LINUX 10.0:
  ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/asterisk-1.0.9-4. 6.ppc.rpm


• SuSE asterisk-1.0.9-4.6.x86_64.rpm
  SUSE LINUX 10.0:
  ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/asterisk-1.0.9 -4.6.x86_64.rpm

Asterisk Asterisk 1.2 .0-beta1

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2 .0-beta2

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2.10

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2.11

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2.11

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2.5

• SuSE asterisk-1.2.5-12.8.i586.rpm
  SUSE LINUX 10.1:
  ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/asterisk-1.2.5-12.8.i 586.rpm


• SuSE asterisk-1.2.5-12.8.ppc.rpm
  SUSE LINUX 10.1:
  ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/asterisk-1.2.5-12.8.pp c.rpm


• SuSE asterisk-1.2.5-12.8.x86_64.rpm
  SUSE LINUX 10.1:
  ftp://ftp.suse.com/pub/suse/update/10.1/rpm/x86_64/asterisk-1.2.5-12.8 .x86_64.rpm

Asterisk Asterisk 1.2.6

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2.7

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2.8

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz

Asterisk Asterisk 1.2.9

• Asterisk asterisk-1.2.13.tar.gz
  http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.13.tar.gz