Asterisk vulnerabilities in chan_skinny.c and chan_sip.c

[magilus]

There are two security flaws in Edgy's Asterisk:

http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050171.html
http://www.securityfocus.com/bid/20835

[magilus (magilus)]

In Feisty, there is 1:1.2.13~dfsg-2ubuntu1, which fixes the issue ( it is a security only release ). This should probably be backported.

[magilus (magilus)]

It seems to successfully build in an Edgy chroot. Sadly, I do not have enough disk space so that I can test the full build procedure. Could anyone try and publish it to Edgy please?

[Kees Cook (kees)]

Hi! If you can provide the security patch debdiff for the edgy package, I'd be happy to get it published for edgy. It can't be a version update, though; only a security path. For a full version backport, you'll need to go through the MOTU SRU procedures.

[magilus (magilus)]

I'll try to find one.

In Asterisk 1.2.13, an other issue has been fixed: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5445

This should be probably fixed, too.

[magilus (magilus)]

CVE 2006-5444 is fixed there:

http://lists.digium.com/pipermail/svn-commits/2006-October/017805.html
http://svn.digium.com/view/asterisk?rev=45332&view=rev

Please recheck if the patch is the correct one. It applies fine to the asterisk_1.2.12.1.dfsg.orig.tar.gz, I didn't make any further investigations.

[magilus (magilus)]

CVE-2006-5445 is harder to fix, because they applied other patches before which do not have any connection to the security hole. But it also seems that this is not critical, in svn commit #45306 they write

"After some research, we realized that the default behaviour since a long
time was doing the right thing, even though the change optimized a bit
and removed a lot of potential risks.

Conclusion: No need for a configuration option at all."
--> http://svn.digium.com/view/asterisk?rev=45306&view=rev

So I would suggest to only fix CVE-2006-5444.

[magilus (magilus)]

I personally do not want to fix this issue for Breezy. If anybody does, feel free to do.

[Marco Rodrigues (gothicx)]

Breezy support is over.. Today it's Breezy End Of Life!