HackDig : Dig high-quality web security articles for hacker

AST-2016-007: UPDATE

2016-10-25 23:55
On September 8, the Asterisk development team released the AST-2016-007
security advisory. The security advisory involved an RTP resource
exhaustion that could be targeted due to a flaw in the "allowoverlap"
option of chan_sip. Due to new information presented to us by Walter
Doekes, we have made the following updates to the advisory.

In the "Description" section, the following text has been added:

UPDATE (20 October, 2016):

It has been brought to our attention by Walter Doekes that
this same leak can be exploited without the use of the
overlap dialing feature. Sending SIP requests in a specific
sequence outside the norm could also cause the leak of RTP
resources. By sending an in-dialog INVITE after receiving a
404 response (but before sending an ACK), an attacker could
cause the same leak to occur."

In the "Resolution" section, the following text has been added:

UPDATE (20 October, 2016):

Because of the updated information from Walter Doekes,
disabling the allowoverlap option is not enough to solve
this issue. Users of Asterisk MUST upgrade to one of the
fixed versions listed below.

The updated advisory can be found at
http://downloads.asterisk.org/pub/security/AST-2016-007.html
and
http://downloads.asterisk.org/pub/security/AST-2016-007.pdf


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/


Source: 39/tcO/6102/erusolcsidlluf/gro.stsilces

Read:474 | Comments:0 | Tags:No Tag

“AST-2016-007: UPDATE”0 Comments

Submit A Comment

Name:

Email:

Blog :

Verification Code:

Announce

Share high-quality web security related articles with you:)

Tools

Tag Cloud