Bug 698916 - (CVE-2011-1507) CVE-2011-1507 Asterisk: file descriptor resource exhaustion (AST-2011-005)
CVE-2011-1507 Asterisk: file descriptor resource exhaustion (AST-2011-005)
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
public=20110421,reported=20110421,sou...
: Security
Depends On: 698918 698919
Blocks:
  Show dependency treegraph
 
Reported: 2011-04-22 05:35 EDT by Jan Lieskovsky
Modified: 2015-07-31 02:39 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-05-16 17:26:30 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2011-04-22 05:35:02 EDT
Asterisk did not limit the number of unauthenticated connections
to vulnerable interfaces and did not limit the time unauthenticated
clients remain connected to some interfaces. A remote attacker
could open many subsequent connections to vulnerable Asterisk interfaces,
leading to file descriptor resource exhaustion or possibly to
disk space exhaustion (due Asterisk feature of logging failures
to open new file descriptors into its log file).

References:
[1] http://downloads.asterisk.org/pub/security/AST-2011-005.html

Upstream patches:
[2] http://downloads.asterisk.org/pub/security/AST-2011-005-1.4.diff
    (against v1.4 branch)
[3] http://downloads.asterisk.org/pub/security/AST-2011-005-1.6.1.diff
    (against v1.6.1 branch)
[4] http://downloads.asterisk.org/pub/security/AST-2011-005-1.6.2.diff
    (against v1.6.2 branch)
[5] http://downloads.asterisk.org/pub/security/AST-2011-005-1.8.diff
    (against v1.8 branch)
Comment 1 Jan Lieskovsky 2011-04-22 05:36:45 EDT
This issue affects the versions of asterisk package, as shipped
with Fedora release of 13 and 14.

This issue affects the version of the asterisk package, as present
within EPEL-6 repository.

Please schedule an update.
Comment 2 Jan Lieskovsky 2011-04-22 05:39:26 EDT
Created asterisk tracking bugs for this issue

Affects: fedora-all [bug 698918]
Affects: epel-6 [bug 698919]
Comment 3 Vincent Danen 2011-05-16 17:26:30 EDT
This is corrected via these builds that have the fixes from upstream:

Fedora-13: asterisk-1.6.2.18-1.fc13
Fedora-14: asterisk-1.6.2.18-1.fc14
Fedora-15: asterisk-1.8.3.3-1.fc15
Fedora-Rawhide: asterisk-1.8.3.3-1.fc16
EPEL-6: asterisk-1.8.3.3-1.el6

Note You need to log in before you can comment on or make changes to this bug.