Bug 698916 (CVE-2011-1507)

Summary: CVE-2011-1507 Asterisk: file descriptor resource exhaustion (AST-2011-005)
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: itamar, jeff, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-05-16 21:26:30 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 698918, 698919    
Bug Blocks:    

Description Jan Lieskovsky 2011-04-22 09:35:02 UTC
Asterisk did not limit the number of unauthenticated connections
to vulnerable interfaces and did not limit the time unauthenticated
clients remain connected to some interfaces. A remote attacker
could open many subsequent connections to vulnerable Asterisk interfaces,
leading to file descriptor resource exhaustion or possibly to
disk space exhaustion (due Asterisk feature of logging failures
to open new file descriptors into its log file).

References:
[1] http://downloads.asterisk.org/pub/security/AST-2011-005.html

Upstream patches:
[2] http://downloads.asterisk.org/pub/security/AST-2011-005-1.4.diff
    (against v1.4 branch)
[3] http://downloads.asterisk.org/pub/security/AST-2011-005-1.6.1.diff
    (against v1.6.1 branch)
[4] http://downloads.asterisk.org/pub/security/AST-2011-005-1.6.2.diff
    (against v1.6.2 branch)
[5] http://downloads.asterisk.org/pub/security/AST-2011-005-1.8.diff
    (against v1.8 branch)

Comment 1 Jan Lieskovsky 2011-04-22 09:36:45 UTC
This issue affects the versions of asterisk package, as shipped
with Fedora release of 13 and 14.

This issue affects the version of the asterisk package, as present
within EPEL-6 repository.

Please schedule an update.

Comment 2 Jan Lieskovsky 2011-04-22 09:39:26 UTC
Created asterisk tracking bugs for this issue

Affects: fedora-all [bug 698918]
Affects: epel-6 [bug 698919]

Comment 3 Vincent Danen 2011-05-16 21:26:30 UTC
This is corrected via these builds that have the fixes from upstream:

Fedora-13: asterisk-1.6.2.18-1.fc13
Fedora-14: asterisk-1.6.2.18-1.fc14
Fedora-15: asterisk-1.8.3.3-1.fc15
Fedora-Rawhide: asterisk-1.8.3.3-1.fc16
EPEL-6: asterisk-1.8.3.3-1.el6