Bug 1173002 (CVE-2014-9374) - CVE-2014-9374 asterisk: Remote Crash Vulnerability in WebSocket Server (AST-2014-019)
Summary: CVE-2014-9374 asterisk: Remote Crash Vulnerability in WebSocket Server (AST-2...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-9374
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1173003
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-12-11 09:47 UTC by Vasyl Kaigorodov
Modified: 2021-10-20 10:48 UTC (History)
5 users (show)

Fixed In Version: asterisk 11.14.2
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-20 10:48:27 UTC
Embargoed:

Attachments (Terms of Use)

Description Vasyl Kaigorodov 2014-12-11 09:47:30 UTC 
Remote crash vulnerability was reported in all Asterisk 11.x versions before 11.14.2.

http://downloads.asterisk.org/pub/security/AST-2014-019.html

When handling a WebSocket frame the res_http_websocket module dynamically changes the size of the memory used to allow the provided payload to fit. If a payload length of zero was received the code would incorrectly attempt to resize to zero. This operation would succeed and end up freeing the memory but be treated as a failure. When the session was subsequently torn down this memory would get freed yet again causing a crash.

Upstream bug for this:
https://issues.asterisk.org/jira/browse/ASTERISK-24472

Upstream patches are available:
http://downloads.asterisk.org/pub/security/AST-2014-019-11.diff

This is fixed in Asterisk Open Source 11.14.2
Comment 1 Vasyl Kaigorodov 2014-12-11 09:47:50 UTC 
Created asterisk tracking bugs for this issue:

Affects: fedora-all [bug 1173003]
Comment 2 Murray McAllister 2014-12-15 03:54:59 UTC 
MITRE assigned CVE-2014-9374 to this issue.
Comment 3 Fedora Update System 2015-07-21 08:16:24 UTC 
asterisk-11.17.1-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.