Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 413353 (CVE-2012-2414) - <net-misc/asterisk-1.8.11.1 : Multiple vulnerabilities (CVE-2012-{2414,2415,2416})
Summary: <net-misc/asterisk-1.8.11.1 : Multiple vulnerabilities (CVE-2012-{2414,2415,2...
Status: RESOLVED FIXED
Alias: CVE-2012-2414
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: B2 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2012-04-24 12:12 UTC by Agostino Sarubbo
Modified: 2012-06-21 00:49 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Agostino Sarubbo gentoo-dev 2012-04-24 12:25:55 UTC
Arches, please test and mark stable:
=net-misc/asterisk-1.8.11.1
Target KEYWORDS="amd64 x86"
Comment 2 Agostino Sarubbo gentoo-dev 2012-04-24 17:03:22 UTC
amd64 stable
Comment 3 headphones 2012-04-25 14:20:48 UTC
I'm not sure if this is the correct place to write this, but Asterisk works fine on ppc and ppc64 as well after unmasking. We've been using source-compiled 1.4 for a while, but recently moved on to the 1.8 ebuilds, without any errors.
Comment 4 Tony Vroon gentoo-dev 2012-04-25 15:20:16 UTC
(In reply to comment #3)
> I'm not sure if this is the correct place to write this, but Asterisk works
> fine on ppc and ppc64 as well after unmasking. We've been using
> source-compiled 1.4 for a while, but recently moved on to the 1.8 ebuilds,
> without any errors.

Do not attempt to hijack bugs, especially not security bugs.
Comment 5 Dan Dexter 2012-04-27 03:03:06 UTC
Archtested on X86: Everything OK.

1) Compiles successfully with various USE-flags.
2) All rdeps compile successfully.
3) No repoman errors reported.
4) I do not have a voip phone but, per ago, I was able to verify the stability of the net-misc/asterisk-1.8.11.1 daemon and it's utilities. I also witnessed no errors of concern in asterisk's log file.
Comment 6 Agostino Sarubbo gentoo-dev 2012-04-27 07:11:13 UTC
x86 stable, thanks Dan.
Comment 7 Agostino Sarubbo gentoo-dev 2012-04-27 07:11:43 UTC
@security, please check the severity and file glsa request.
Comment 8 Sean Amoss gentoo-dev Security 2012-04-27 10:09:53 UTC
Thanks, everyone. GLSA is already drafted and ready for review.
Comment 9 GLSAMaker/CVETool Bot gentoo-dev 2012-05-01 19:42:18 UTC
CVE-2012-2416 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2416):
  chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before
  1.8.11.1 and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before
  C.3.7.4, when the trustrpid option is enabled, allows remote authenticated
  users to cause a denial of service (daemon crash) by sending a SIP UPDATE
  message that triggers a connected-line update attempt without an associated
  channel.

CVE-2012-2415 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2415):
  Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in
  Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and
  10.x before 10.3.1 allows remote authenticated users to cause a denial of
  service or possibly have unspecified other impact via a series of
  KEYPAD_BUTTON_MESSAGE events.

CVE-2012-2414 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2414):
  main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x
  before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk
  Business Edition C.3.x before C.3.7.4 does not properly enforce System class
  authorization requirements, which allows remote authenticated users to
  execute arbitrary commands via (1) the originate action in the MixMonitor
  application, (2) the SHELL and EVAL functions in the GetVar manager action,
  or (3) the SHELL and EVAL functions in the Status manager action.
Comment 10 GLSAMaker/CVETool Bot gentoo-dev 2012-06-21 00:49:59 UTC
This issue was resolved and addressed in
 GLSA 201206-05 at http://security.gentoo.org/glsa/glsa-201206-05.xml
by GLSA coordinator Sean Amoss (ackle).