CVE-2011-0495: AST-2011-001: Asterisk: Stack based buffer overflow by forming an outgoing SIP request with specially-crafted caller ID information

[Darik Horn]

Binary package hint: asterisk

All of the Asterisk packages in Ubuntu need to be patched for AST-2011-001, which is tentatively CVE-2011-0495.

See: http://downloads.asterisk.org/pub/security/AST-2011-001.html

Although Asterisk in currently in the universe repository, it would nevertheless be appreciated to get the security fix. Debian already has the fix pending in their pkg-voip tree.

[Paul Belanger (pabelanger)]

Slightly on topic, do you mind outputting the bzr commands you used to branch from lp:ubuntu/asterisk to lp:~davewalker/ubuntu/natty/asterisk/lp_705014? I started work patches this morning, but got bogged down in bzr.

Additionally, it don't look like we have an up-to-date branch for asterisk packages using bzr-buildpackage, unless I'm missing something.

[Dave Walker (davewalker)]

Hi Paul,

It's probably better to join freenode IRC, #ubuntu-devel, or #ubuntu-motu. My IRC nick is Daviey, i am happy to help.

[Jamie Strandboge (jdstrand)]

Dapper is EOL for everything except a subset of main and restricted packages right now, so I am going to decline the Dapper task unless someone wants to provide a patch and the testing.

[Launchpad Janitor (janitor)]

This bug was fixed in the package asterisk - 1:1.6.2.9-2ubuntu2

---------------
asterisk (1:1.6.2.9-2ubuntu2) natty; urgency=low

  * SECURITY UPDATE: Stack buffer overflow in SIP channel driver. (LP: #705014)
    - debian/patches/AST-2011-001-1.6.2: The size of the output buffer passed
      to the ast_uri_encode function is now properly respected in main/utils.c.
      Patch courtesy of upstream.
    - CVE-2011-0495
 -- Dave Walker (Daviey) <email address hidden> Thu, 20 Jan 2011 21:19:46 +0000

[Jamie Strandboge (jdstrand)]

Uploaded maverick/1:1.6.2.7-1ubuntu1.1 to the security PPA.

[Jamie Strandboge (jdstrand)]

Uploaded lucid/1:1.6.2.5-0ubuntu1.3 to the security PPA.

[Launchpad Janitor (janitor)]

This bug was fixed in the package asterisk - 1:1.6.2.7-1ubuntu1.1

---------------
asterisk (1:1.6.2.7-1ubuntu1.1) maverick-security; urgency=low

  * SECURITY UPDATE: Stack buffer overflow in SIP channel driver. (LP: #705014)
    - debian/patches/AST-2011-001-1.6.2: The size of the output buffer passed
      to the ast_uri_encode function is now properly respected in main/utils.c.
      Patch courtesy of upstream.
    - CVE-2011-0495
 -- Dave Walker (Daviey) <email address hidden> Thu, 20 Jan 2011 23:36:57 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package asterisk - 1:1.6.2.5-0ubuntu1.3

---------------
asterisk (1:1.6.2.5-0ubuntu1.3) lucid-security; urgency=low

  * SECURITY UPDATE: Stack buffer overflow in SIP channel driver. (LP: #705014)
    - debian/patches/AST-2011-001-1.6.2: The size of the output buffer passed
      to the ast_uri_encode function is now properly respected in main/utils.c.
      Patch courtesy of upstream.
    - CVE-2011-0495
 -- Dave Walker (Daviey) <email address hidden> Thu, 20 Jan 2011 23:31:55 +0000

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. karmic has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against karmic is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug and helping to make Ubuntu better. The package referred to in this bug is in universe or multiverse and reported against a release of Ubuntu (hardy) which no longer receives updates outside of the explicitly supported LTS packages. While the bug against hardy is being marked "Won't Fix" for now, if you are interested feel free to post a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures'

Please feel free to report any other bugs you may find.