Bug 698916 – CVE-2011-1507 Asterisk: file descriptor resource exhaustion (AST-2011-005)

Bug 698916 - (CVE-2011-1507) CVE-2011-1507 Asterisk: file descriptor resource exhaustion (AST-2011-005)

Summary:	CVE-2011-1507 Asterisk: file descriptor resource exhaustion (AST-2011-005)

Status:	CLOSED ERRATA

Aliases:	CVE-2011-1507

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	public=20110421,reported=20110421,sou...
Keywords:	Security

Depends On:	698918 698919
Blocks:
	Show dependency tree / graph

Reported:	2011-04-22 05:35 EDT by Jan Lieskovsky
Modified:	2015-07-31 02:39 EDT (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2011-05-16 17:26:30 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Jan Lieskovsky 2011-04-22 05:35:02 EDT

Asterisk did not limit the number of unauthenticated connections
to vulnerable interfaces and did not limit the time unauthenticated
clients remain connected to some interfaces. A remote attacker
could open many subsequent connections to vulnerable Asterisk interfaces,
leading to file descriptor resource exhaustion or possibly to
disk space exhaustion (due Asterisk feature of logging failures
to open new file descriptors into its log file).

References:
[1] http://downloads.asterisk.org/pub/security/AST-2011-005.html

Upstream patches:
[2] http://downloads.asterisk.org/pub/security/AST-2011-005-1.4.diff
    (against v1.4 branch)
[3] http://downloads.asterisk.org/pub/security/AST-2011-005-1.6.1.diff
    (against v1.6.1 branch)
[4] http://downloads.asterisk.org/pub/security/AST-2011-005-1.6.2.diff
    (against v1.6.2 branch)
[5] http://downloads.asterisk.org/pub/security/AST-2011-005-1.8.diff
    (against v1.8 branch)

Comment 1 Jan Lieskovsky 2011-04-22 05:36:45 EDT

This issue affects the versions of asterisk package, as shipped
with Fedora release of 13 and 14.

This issue affects the version of the asterisk package, as present
within EPEL-6 repository.

Please schedule an update.

Comment 2 Jan Lieskovsky 2011-04-22 05:39:26 EDT

Created asterisk tracking bugs for this issue

Affects: fedora-all [bug 698918]
Affects: epel-6 [bug 698919]

Comment 3 Vincent Danen 2011-05-16 17:26:30 EDT

This is corrected via these builds that have the fixes from upstream:

Fedora-13: asterisk-1.6.2.18-1.fc13
Fedora-14: asterisk-1.6.2.18-1.fc14
Fedora-15: asterisk-1.8.3.3-1.fc15
Fedora-Rawhide: asterisk-1.8.3.3-1.fc16
EPEL-6: asterisk-1.8.3.3-1.el6

Note You need to log in before you can comment on or make changes to this bug.