asterisk announce - Jul 2008 - AST-2008-011: Traffic amplification in IAX2 firmware provisioning system

Asterisk Project Security Advisory - AST-2008-011

   +------------------------------------------------------------------------+
   |      Product       | Asterisk                                          |
   |--------------------+---------------------------------------------------|
   |      Summary       | Traffic amplification in IAX2 firmware            |
   |                    | provisioning system                               |
   |--------------------+---------------------------------------------------|
   | Nature of Advisory | Traffic amplification attack                      |
   |--------------------+---------------------------------------------------|
   |   Susceptibility   | Remote unauthenticated sessions                   |
   |--------------------+---------------------------------------------------|
   |      Severity      | Critical                                          |
   |--------------------+---------------------------------------------------|
   |   Exploits Known   | No                                                |
   |--------------------+---------------------------------------------------|
   |    Reported On     | July 18, 2008                                     |
   |--------------------+---------------------------------------------------|
   |    Reported By     | Tilghman Lesher < tlesher AT digium DOT com >   
|
   |--------------------+---------------------------------------------------|
   |     Posted On      | July 22, 2008                                     |
   |--------------------+---------------------------------------------------|
   |  Last Updated On   | July 22, 2008                                     |
   |--------------------+---------------------------------------------------|
   |  Advisory Contact  | Tilghman Lesher < tlesher AT digium DOT com >   
|
   |--------------------+---------------------------------------------------|
   |      CVE Name      | CVE-2008-3264                                     |
   +------------------------------------------------------------------------+

   +------------------------------------------------------------------------+
   | Description | An attacker may request an Asterisk server to send part  |
   |             | of a firmware image. However, as this firmware download  |
   |             | protocol does not initiate a handshake, the source       |
   |             | address may be spoofed. Therefore, an IAX2 FWDOWNL       |
   |             | request for a firmware file may consume as little as 40  |
   |             | bytes, yet produces a 1040 byte response. Coupled with   |
   |             | multiple geographically diverse Asterisk servers, an     |
   |             | attacker may flood an victim site with unwanted firmware |
   |             | packets.                                                 |
   +------------------------------------------------------------------------+

   +------------------------------------------------------------------------+
   | Workaround | The only device which used this firmware upgrade          |
   |            | procedure was the IAXy ATA device, and the last firmware  |
   |            | upgrade was more than 18 months ago. It is unlikely that  |
   |            | any IAXy devices in use today still need the last         |
   |            | firmware upgrade. Therefore, deleting the firmware image  |
   |            | from the directory where it is served from and sending a  |
   |            | reload event to the Asterisk server is sufficient to      |
   |            | purge the firmware image from the Asterisk server's      
|
   |            | memory. An Asterisk server which is unable to serve out   |
   |            | the requested firmware image will reply to any such       |
   |            | request with a much smaller REJECT packet, which is       |
   |            | smaller than even the FWDOWNL packet.                     |
   +------------------------------------------------------------------------+

   +------------------------------------------------------------------------+
   | Resolution | This firmware download procedure has been disabled by     |
   |            | default in Asterisk. If you should still need to upgrade  |
   |            | IAXys in the field, there is an option
'allowfwdownload'  |
   |            | which can be enabled. However, due to the reasons         |
   |            | specified on the Workaround section, it is recommended    |
   |            | that you leave this option disabled and enable it only on |
   |            | secure internal networks when an IAXy is initially        |
   |            | provisioned.                                              |
   +------------------------------------------------------------------------+

   +------------------------------------------------------------------------+
   |                           Affected Versions                            |
   |------------------------------------------------------------------------|
   |             Product              |   Release   |                       |
   |                                  |   Series    |                       |
   |----------------------------------+-------------+-----------------------|
   |       Asterisk Open Source       |    1.0.x    | All versions          |
   |----------------------------------+-------------+-----------------------|
   |       Asterisk Open Source       |    1.2.x    | All versions prior to |
   |                                  |             | 1.2.30                |
   |----------------------------------+-------------+-----------------------|
   |       Asterisk Open Source       |    1.4.x    | All versions prior to |
   |                                  |             | 1.4.21.2              |
   |----------------------------------+-------------+-----------------------|
   |         Asterisk Addons          |    1.2.x    | Not affected          |
   |----------------------------------+-------------+-----------------------|
   |         Asterisk Addons          |    1.4.x    | Not affected          |
   |----------------------------------+-------------+-----------------------|
   |    Asterisk Business Edition     |    A.x.x    | All versions          |
   |----------------------------------+-------------+-----------------------|
   |    Asterisk Business Edition     |    B.x.x    | All versions prior to |
   |                                  |             | B.2.5.4               |
   |----------------------------------+-------------+-----------------------|
   |    Asterisk Business Edition     |    C.x.x    | All versions prior to |
   |                                  |             | C.1.10.3              |
   |----------------------------------+-------------+-----------------------|
   |           AsteriskNOW            | pre-release | All versions          |
   |----------------------------------+-------------+-----------------------|
   | Asterisk Appliance Developer Kit |    0.x.x    | All versions          |
   |----------------------------------+-------------+-----------------------|
   |    s800i (Asterisk Appliance)    |    1.0.x    | All versions prior to |
   |                                  |             | 1.2.0.1               |
   +------------------------------------------------------------------------+

   +------------------------------------------------------------------------+
   |                              Corrected In                              |
   |------------------------------------------------------------------------|
   |                   Product                   |         Release          |
   |---------------------------------------------+--------------------------|
   |            Asterisk Open Source             |          1.2.30          |
   |---------------------------------------------+--------------------------|
   |            Asterisk Open Source             |         1.4.21.2         |
   |---------------------------------------------+--------------------------|
   |          Asterisk Business Edition          |         B.2.5.4          |
   |---------------------------------------------+--------------------------|
   |          Asterisk Business Edition          |         C.1.10.3         |
   |---------------------------------------------+--------------------------|
   |          Asterisk Business Edition          |         C.2.0.3          |
   |---------------------------------------------+--------------------------|
   |         s800i (Asterisk Appliance)          |         1.2.0.1          |
   +------------------------------------------------------------------------+

   +------------------------------------------------------------------------+
   |        Links        |                                                  |
   +------------------------------------------------------------------------+

   +------------------------------------------------------------------------+
   | Asterisk Project Security Advisories are posted at                     |
   | http://www.asterisk.org/security                                       |
   |                                                                        |
   | This document may be superseded by later versions; if so, the latest   |
   | version will be posted at                                              |
   | http://downloads.digium.com/pub/security/AST-2008-011.pdf and          |
   | http://downloads.digium.com/pub/security/AST-2008-011.html             |
   +------------------------------------------------------------------------+

   +------------------------------------------------------------------------+
   |                            Revision History                            |
   |------------------------------------------------------------------------|
   |      Date       |       Editor       |         Revisions Made          |
   |-----------------+--------------------+---------------------------------|
   | July 22, 2008   | Tilghman Lesher    | Initial release                 |
   |-----------------+--------------------+---------------------------------|
   | July 22, 2008   | Tilghman Lesher    | Revised C.1 version numbers     |
   +------------------------------------------------------------------------+

               Asterisk Project Security Advisory - AST-2008-011
              Copyright (c) 2008 Digium, Inc. All Rights Reserved.
  Permission is hereby granted to distribute and publish this advisory in its
                           original, unaltered form.