Asterisk 'milliwatt () 'access denied Vulnerability

Release date: 2012-03-16
Updated on: 2012-03-19

Affected Systems:
Asterisk 10.x
Asterisk 1.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 52523

Asterisk is a free and open-source software that enables the Telephone User Switch (PBX) function.

Multiple Remote Denial-of-Service vulnerabilities exist in Asterisk implementation. Remote attackers can exploit these vulnerabilities to cause application crash, DOS legal users, and control affected systems.

1) When copying an internal data example, an error occurs in the Milliwatt application in the "milliwatt_generate ()" function (apps/app_milliwatt.c). specially crafted packets can cause a crash.

2) when processing the "HTTP Digest Authentication" information, there is an error in the "ast_parse_digest ()" function (main/utils. c). A stack buffer overflow can be caused by a long string.

<* Source: Russell Bryant (russell@digium.com)

Link: http://secunia.com/advisories/48417/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Asterisk
--------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://downloads.asterisk.org/pub/security/