Asterisk Development Team
2016-Feb-04 01:56 UTC
[asterisk-users] Asterisk 11.6-cert12, 11.21.1, 13.1-cert3, 13.7.1 Now Available (Security Release)
The Asterisk Development Team has announced security releases for Certified Asterisk 11.6 and 13.1 and Asterisk 11 and 13. The available security releases are released as versions 11.6-cert12, 11.21.1, 13.1-cert3, and 13.7.1. These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases The release of these versions resolves the following security vulnerabilities: * AST-2016-001: BEAST vulnerability in HTTP server The Asterisk HTTP server currently has a default configuration which allows the BEAST vulnerability to be exploited if the TLS functionality is enabled. This can allow a man-in-the-middle attack to decrypt data passing through it. * AST-2016-002: File descriptor exhaustion in chan_sip Setting the sip.conf timert1 value to a value higher than 1245 can cause an integer overflow and result in large retransmit timeout times. These large timeout values hold system file descriptors hostage and can cause the system to run out of file descriptors. * AST-2016-003: Remote crash vulnerability receiving UDPTL FAX data. If no UDPTL packets are lost there is no problem. However, a lost packet causes Asterisk to use the available error correcting redundancy packets. If those redundancy packets have zero length then Asterisk uses an uninitialized buffer pointer and length value which can cause invalid memory accesses later when the packet is copied. For a full list of changes in the current releases, please see the ChangeLogs: http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-11.6-cert12 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.21.1 http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-13.1-cert3 http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.7.1 The security advisories are available at: * http://downloads.asterisk.org/pub/security/AST-2016-001.pdf * http://downloads.asterisk.org/pub/security/AST-2016-002.pdf * http://downloads.asterisk.org/pub/security/AST-2016-003.pdf Thank you for your continued support of Asterisk!