Asterisk Security Team
2012-May-29 21:55 UTC
[asterisk-announce] AST-2012-008: Skinny Channel Driver Remote Crash Vulnerability
Asterisk Project Security Advisory - AST-2012-008
Product Asterisk
Summary Skinny Channel Driver Remote Crash Vulnerability
Nature of Advisory Denial of Service
Susceptibility Remote authenticated sessions
Severity Minor
Exploits Known No
Reported On May 22, 2012
Reported By Christoph Hebeisen
Posted On May 29, 2012
Last Updated On May 29, 2012
Advisory Contact Matt Jordan < mjordan AT digium DOT com >
CVE Name CVE-2012-2948
Description As reported by Telus Labs:
"A Null-pointer dereference has been identified in the
SCCP
(Skinny) channel driver of Asterisk. When an SCCP client
closes its connection to the server, a pointer in a
structure is set to Null. If the client was not in the
on-hook state at the time the connection was closed, this
pointer is later dereferenced.
A remote attacker with a valid SCCP ID can can use this
vulnerability by closing a connection to the Asterisk
server in certain call states (e.g. "Off hook") to
crash
the server. Successful exploitation of this vulnerability
would result in termination of the server, causing denial
of service to legitimate users."
Resolution The pointer to the device in the structure is now checked
before it is dereferenced in the channel event callbacks and
message handling functions.
Affected Versions
Product Release Series
Asterisk Open Source 1.8.x All Versions
Asterisk Open Source 10.x All Versions
Certified Asterisk 1.8.11-cert 1.8.11-cert1
Corrected In
Product Release
Asterisk Open Source 1.8.12.1, 10.4.1
Certified Asterisk 1.8.11-cert2
Patches
SVN URL
Revision
http://downloads.asterisk.org/pub/security/AST-2012-008-1.8.diff v1.8
http://downloads.asterisk.org/pub/security/AST-2012-008-10.diff v10
http://downloads.asterisk.org/pub/security/AST-2012-008-1.8.11-cert.diff
v1.8.11-cert
Links https://issues.asterisk.org/jira/browse/ASTERISK-19905
Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security
This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2012-008.pdf and
http://downloads.digium.com/pub/security/AST-2012-008.html
Revision History
Date Editor Revisions Made
05/25/2012 Matt Jordan Initial Release
Asterisk Project Security Advisory - AST-2012-008
Copyright (c) 2012 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.