7.5 - GLSA-201203-21

Synopsis

Multiple vulnerabilities have been found in Asterisk, the worst of which may allow execution of arbitrary code.

Background

Asterisk is an open source telephony engine and toolkit.

Description

Two vulnerabilities have been found in Asterisk:

* The "milliwatt_generate()" function in app_milliwatt.c is vulnerable to a stack overrun (AST-2012-002).
* The "ast_parse_digest()" function in utils.c is vulnerable to a stack-based buffer overflow (AST-2012-003).

Impact

A remote unauthenticated attacker could execute arbitrary code or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Asterisk users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.8.10.1"

References

[ 1 ] AST-2012-002
http://downloads.asterisk.org/pub/security/AST-2012-002.txt
[ 2 ] AST-2012-003
http://downloads.asterisk.org/pub/security/AST-2012-003.txt
[ 3 ] CVE-2012-1183 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1183
[ 4 ] CVE-2012-1184 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1184

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201203-21.xml