Exploitalert - Database of Exploits

Resource Exhaustion Vulnerability in Asterisk SIP channel driver

CVE	Category	Price	Severity
CVE-2007-4455	CWE-400	$5,000	High

Author	Risk	Exploitation Type	Date
Xiao Wei	High	Remote	2007-08-26

CPE
cpe:cpe:/a:asterisk:sip_channel_driver

CVSS	EPSS	EPSSP
CVSS:4.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	0.068509	0.9822

CVSS vector description

Metric	Value	Metric Description	Value Description
Attack vector	Local	AV	The vulnerable system is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or through terminal emulation (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).
Attack Complexity	Low	AC	The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required	Low	PR	The attacker requires privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.
User Interaction	None	UI	The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges
Scope	Unchanged	S	An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality	None	C	There is no impact on the confidentiality of the system; the attacker does not gain the ability to read any data.
Integrity	None	I	There is no impact on the integrity of the system; the attacker does not gain the ability to modify any files or information on the target system.
Availability	High	A	There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.

http://cxsecurity.com/ascii/WLB-2007080001

Asterisk Project Security Advisory - AST-2007-020 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | Resource Exhaustion vulnerability in SIP channel | | | driver | |--------------------+---------------------------------------------------| | Nature of Advisory | Denial of Service | |--------------------+---------------------------------------------------| | Susceptibility | Remote Unauthenticated Sessions | |--------------------+---------------------------------------------------| | Severity | Moderate | |--------------------+---------------------------------------------------| | Exploits Known | No | |--------------------+---------------------------------------------------| | Reported On | August 9, 2007 | |--------------------+---------------------------------------------------| | Reported By | Jon Moldenauer (bugs.digium.com user | | | jmoldenhauer) | |--------------------+---------------------------------------------------| | Posted On | August 21, 2007 | |--------------------+---------------------------------------------------| | Last Updated On | August 21, 2007 | |--------------------+---------------------------------------------------| | Advisory Contact | Russell Bryant <russell_at_digium.com> | |--------------------+---------------------------------------------------| | CVE Name | CVE-2007-4455 | +------------------------------------------------------------------------+ +------------------------------------------------------------------------+ | Description | The handling of SIP dialog history was broken during the | | | development of Asterisk 1.4. Regardless of whether | | | recording SIP dialog history is turned on or off, the | | | history is still recorded in memory. Furthermore, there | | | is no upper limit on how many history items will be | | | stored for a given SIP dialog. | | | | | | It is possible for an attacker to use up all of the | | | system's memory by creating a SIP dialog that records | | | many entires in the history and never ends. It is also | | | worth noting for the sake of doing the math to calculate | | | what it would take to exploit this that each SIP history | | | entry will take up a maximum of 88 bytes. | +------------------------------------------------------------------------+ +------------------------------------------------------------------------+ | Resolution | The fix that has been added to chan_sip is to restore the | | | functionality where SIP dialog history is not recorded in | | | memory if it is not enabled. Furthermore, a maximum of 50 | | | entires in the history will be stored for each dialog | | | when recording history is turned on. | | | | | | The only way to avoid this problem in affected versions | | | of Asterisk is to disable chan_sip. If chan_sip is being | | | used, the system must be upgraded to a version that has | | | this issue resolved. | +------------------------------------------------------------------------+ +------------------------------------------------------------------------+ | Affected Versions | |------------------------------------------------------------------------| | Product | Release | | | | Series | | |----------------------------------+-------------+-----------------------| | Asterisk Open Source | 1.0.x | Not affected | |----------------------------------+-------------+-----------------------| | Asterisk Open Source | 1.2.x | Not affected | |----------------------------------+-------------+-----------------------| | Asterisk Open Source | 1.4.x | All versions prior to | | | | 1.4.11 | |----------------------------------+-------------+-----------------------| | Asterisk Business Edition | A.x.x | Not affected | |----------------------------------+-------------+-----------------------| | Asterisk Business Edition | B.x.x | Not affected | |----------------------------------+-------------+-----------------------| | AsteriskNOW | pre-release | All versions prior to | | | | beta7 | |----------------------------------+-------------+-----------------------| | Asterisk Appliance Developer Kit | 0.x.x | All versions prior to | | | | 0.8.0 | |----------------------------------+-------------+-----------------------| | s800i (Asterisk Appliance) | 1.0.x | All versions prior to | | | | 1.0.3 | +------------------------------------------------------------------------+ +------------------------------------------------------------------------+ | Corrected In | |------------------------------------------------------------------------| | Product | Release | |---------------+--------------------------------------------------------| | Asterisk Open | 1.4.11, available from | | Source | http://downloads.digium.com/pub/telephony/asterisk | |---------------+--------------------------------------------------------| | AsteriskNOW | Beta7, available from http://www.asterisknow.org/. | | | Beta5 and Beta6 users can update using the system | | | update feature in the appliance control panel. | |---------------+--------------------------------------------------------| | Asterisk | 0.8.0, available from | | Appliance | http://downloads.digium.com/pub/telephony/aadk | | Developer Kit | | |---------------+--------------------------------------------------------| | s800i | 1.0.3 | | (Asterisk | | | Appliance) | | +------------------------------------------------------------------------+ +------------------------------------------------------------------------+ | Links | http://bugs.digium.com/view.php?id=10421 | | | | | | http://bugs.digium.com/view.php?id=10418 | +------------------------------------------------------------------------+ +------------------------------------------------------------------------+ | Asterisk Project Security Advisories are posted at | | http://www.asterisk.org/security. | | | | This document may be superseded by later versions; if so, the latest | | version will be posted at | | http://downloads.digium.com/pub/asa/AST-2007-020.pdf and | | http://downloads.digium.com/pub/asa/AST-2007-020.html. | +------------------------------------------------------------------------+ +------------------------------------------------------------------------+ | Revision History | |------------------------------------------------------------------------| | Date | Editor | Revisions Made | |---------------------+------------------------+-------------------------| | August 21, 2007 | russell_at_digium.com | Initial Release | +------------------------------------------------------------------------+ Asterisk Project Security Advisory - AST-2007-020 Copyright (c) 2007 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form.

Impressum