Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 131096

Summary: net-misc/asterisk Integer signedness error (CVE-2006-1827)
Product: Gentoo Security Reporter: Sune Kloppenborg Jeppesen (RETIRED) <jaervosz>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: rajiv, stkn
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1827
Whiteboard: C2? [noglsa] jaervosz
Package list:
Runtime testing required: ---

Description Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-04-24 06:56:14 UTC
Integer signedness error in format_jpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length.

From Asterisk 1.2.7 Changelog
+2006-04-08 19:20 +0000 [r18436-18494]  Tilghman Lesher <tilghman@mail.jeffandtilghman.com>
+
+	* formats/format_jpeg.c: Bug 6913 - fix for possible buffer
+	  overflow
Comment 1 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-04-24 06:57:35 UTC
It appears that all previous versions are affected. Please advise and patch as necessary.
Comment 3 solar (RETIRED) gentoo-dev 2006-04-24 07:35:25 UTC
The last hunk of the patch is all we should need if we are backporting.
Comment 4 Stefan Knoblich (RETIRED) gentoo-dev 2006-04-24 11:06:09 UTC
Affected asterisk-1.2.x have been dropped, all asterisk-1.0.x ebuilds have been revision bumped, the following versions need to be marked stable:

sparc:
1.0.10-r2
1.0.8-r3

x86:
1.0.8-r3
1.0.7-r4
Comment 5 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-04-24 11:57:41 UTC
Thx Stefan.

Could you advise on how this is exploitable?

x86 and sparc please test and mark stable.
Comment 6 Mark Loeser (RETIRED) gentoo-dev 2006-04-24 15:03:20 UTC
rajiv: you normally handle asterisk for x86, could you please test those for us? :)  or Stefan.  None of us have a set up with which to test it, so I'm more comfortable having one of you two do it.
Comment 7 Gustavo Zacarias (RETIRED) gentoo-dev 2006-04-25 11:41:45 UTC
sparc stable.
Comment 8 Mark Loeser (RETIRED) gentoo-dev 2006-04-26 12:14:11 UTC
I can't really test the functionality, but everything compiles and starts up fine, and all of the binaries seem to do what they are told :)

Stable on x86
Comment 9 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-04-26 22:06:57 UTC
According to stkn this is only exploitable for channels that support images (IAX2). Furthermore the picture has to be explicitly opened.

So I guess we should have a vote?
Comment 10 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-04-27 14:26:20 UTC
don't know.... i would tend to vote no.
Comment 11 Stefan Cornelius (RETIRED) gentoo-dev 2006-04-28 08:58:29 UTC
I tend to say NO, too.
Comment 12 Thierry Carrez (RETIRED) gentoo-dev 2006-04-28 10:48:43 UTC
Picture has to be opened so rerating. I tend to vote yes, unless convinced that it really needs a PEBKAC to work.
Comment 13 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-04-30 23:32:13 UTC
Debian just released an advisory on this issue along with CVE-2005-3559.
Comment 14 Tavis Ormandy (RETIRED) gentoo-dev 2006-05-01 04:05:26 UTC
After discussing it with jaervosz, I vote NO
Comment 15 Thierry Carrez (RETIRED) gentoo-dev 2006-05-01 11:48:45 UTC
No GLSA then