Bug 853526 (CVE-2012-4737)

Summary:	CVE-2012-4737 Asterisk: ACL rules ignored when placing outbound calls by certain IAX2 users
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	itamar, jeff, lmadsen, rbryant
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-12-11 09:10:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	853527, 853528, 853531
Bug Blocks:

Description Kurt Seifried 2012-08-31 19:38:41 UTC

AST-2012-013

When an IAX2 call is made using the credentials of a peer defined in a dynamic
Asterisk Realtime Architecture (ARA) backend, the ACL rules for that peer are not
applied to the call attempt.  This allows for a remote attacker who is aware of a
peer's credentials to bypass the ACL rules set for that peer. 

This was originally reported by "Alan Frisch"

http://downloads.asterisk.org/pub/security/AST-2012-013.pdf
http://downloads.asterisk.org/pub/security/AST-2012-013.1.8.diff
http://downloads.asterisk.org/pub/security/AST-2012-013.10.diff

Comment 1 Kurt Seifried 2012-08-31 19:39:42 UTC

Created asterisk tracking bugs for this issue

Affects: fedora-16 [bug 853527]

Comment 2 Kurt Seifried 2012-08-31 19:40:15 UTC

Created asterisk tracking bugs for this issue

Affects: fedora-17 [bug 853528]

Comment 3 Kurt Seifried 2012-08-31 19:41:03 UTC

Created asterisk tracking bugs for this issue

Affects: epel-6 [bug 853531]

Comment 4 Kurt Seifried 2012-08-31 19:41:41 UTC

Please note: the links to the diffs are currently 404, emailed upstream.

Comment 5 Kurt Seifried 2012-12-11 09:10:16 UTC

asterisk-1.8.18.0-1.el6 has been pushed to the Epel 6 repository.  If problems still persist, please make note of it in this bug report.

asterisk-1.8.18.0-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.

asterisk-10.10.0-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.