Bug#552756: AST-2009-007: SIP INVITE ACL bypass

Package: asterisk
Version: 1:1.6.2.0~dfsg~rc1-1
Severity: grave
Tags: security patch

Hi,

A vulnerability has been reported in asterisk that allows a device to make
calls on networks intended to be prohibited as defined by the "deny"
and "permit" lines in sip.conf.

The original advisory can be found at:
http://downloads.asterisk.org/pub/security/AST-2009-007.html

And the patch at:
http://downloads.asterisk.org/pub/security/AST-2009-007-1.6.1.diff.txt

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry, whenever one is assigned.

Cheers,
--
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net



--
To UNSUBSCRIBE, email to debian-bugs-rc-REQUEST RemoveThis @lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster RemoveThis @lists.debian.org

Hi,

2009/10/29 Faidon Liambotis <paravoid.DeleteThis@debian.org>:
> Raphael Geissert wrote:
>> Yes, the versions in testing and unstable (at least those that were
>> there before I reported it) were both affected. May I suggest you to
>> reply to the email in the future whenever you don't think it affects a
>> version? the versions in the descriptions are usually not exclusive
>> and should be treated as 'at least' (not much we can do, as it is
>> mitre who writes the descriptions).
> Reply to which email?

The bug report

>
> And FWIW, Asterisk security advisories mention version numbers
> explicitelly and do not follow the "at least" rule.
>
> However, the version that we ship in unstable is a release candidate
> (rc3) for 1.6.2 and hence is not mentioned at all in those advisories.
> That was the source of the confusion.

Ah, right, sorry, I though the description came from the CVE (but
there's none assigned, to the best of my knowledge, yet).

Cheers,
--
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net



--
To UNSUBSCRIBE, email to debian-bugs-rc-REQUEST.DeleteThis@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster.DeleteThis@lists.debian.org