Bugzilla Bug 169616

"This release contains a number of bug fixes, including a fix for a recently
discovered security vulnerability. All Asterisk 1.2 users are urged to update
to this release as soon as possible."

Similar story for the asterisk 1.4 branch, please update to 1.4.1 there.

stkn/voip-herd, please provide an updated ebuild

asterisk 1.0.12 is also vulnerable but not supported upstream. i will patch in
our cvs shortly.

*** Bug 169681 has been marked as a duplicate of this bug. ***

net-misc/asterisk-1.0.12-r1 with ported patch in cvs as ~x86 and ~ppc.

x86 team: please test and mark stable (or drop me an email and i will do it).

older 1.0.12 version is ~ppc also so nothing to be done there.

fyi, vulnerability notice:
http://labs.musecurity.com/advisories/MU-200703-01.txt

Just as a reminder, 1.2.* needs to be fixed too

Secunia says 1.2.16 fixes that vulnerability

Secunia: http://secunia.com/advisories/24380/

rajiv, please bump 1.2.* too, so we can stabilize both.

Rajiv just handles the 1.0 branch.
I can handle 1.2 but i'm waiting for a newer upstream
(http://www.junghanns.net/downloads/) BRIstuff patch since PRE-1y isn't
1.2.16-friendly.
Otherwise we could just try to patch the offending code in asterisk and do a
revbump.

(In reply to comment #7)
> Rajiv just handles the 1.0 branch.
> I can handle 1.2 but i'm waiting for a newer upstream
> (http://www.junghanns.net/downloads/) BRIstuff patch since PRE-1y isn't
> 1.2.16-friendly.
> Otherwise we could just try to patch the offending code in asterisk and do a
> revbump.

 Maybe the best solution if you can't tell how long the newer patch may take to
be provided.

Debian appears to have a BRIstuff PRE-1x patch for 1.2.16 if it's any help.
Otherwise just a simple patch similar to the one for 1.0 branch would be fine.

fyi the original patch for 1.2.x and 1.4.x is available at
http://svn.digium.com/view/asterisk?rev=57478&view=rev

Actually it's r57475 for asterisk-1.2 (r57478 is for 1.4).
Committed in asterisk-1.2.14-r1.
Will need =net-libs/libpri-1.2.4-r1 and =net-misc/zaptel-1.2.12-r1 stable with
this too to match BRIstuff.
sparc stable btw.

Thanks Gustavo.

x86 please test and mark stable:
net-misc/asterisk-1.2.14-r1
net-libs/libpri-1.2.4-r1
net-misc/zaptel-1.2.12-r1

(In reply to comment #12)
> Thanks Gustavo.
> 
> x86 please test and mark stable:
> net-misc/asterisk-1.2.14-r1
> net-libs/libpri-1.2.4-r1
> net-misc/zaptel-1.2.12-r1

And 1.0.12-r1, too. Done.

I vote yes for that VoIP platform for which disponibility is important.

Let's have a GLSA on this one.

GLSA drafted and ready for review.

GLSA 200703-14