Vulnerabilities > CVE-2007-3765 - Unspecified vulnerability in Asterisk products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.
Vulnerable Configurations
Seebug
| bulletinFamily | exploit |
| description | BUGTRAQ ID: 24950 CVE(CAN) ID: CVE-2007-3763,CVE-2007-3764,CVE-2007-3765 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 Asterisk IAX2的隧道驱动（chan_iax2）中存在拒绝服务漏洞。如果Asterisk在有效会话中接收到了LAGRQ或LAGRP帧，就可能触发空指针异常。负责解析入站帧的代码可以正确地解析IAX帧中的信息单元，然后将指针设置为空表示没有与这个帧相关的原始数据负载，但没有将原始负载中用于表示字节数的变量设置为0。由于原始数据长度为非0，处理LAGRQ和LAGRP帧的代码就会试图从空指针拷贝数据，导致崩溃。 Asterisk轻型隧道驱动（chan_skinny）中存在拒绝服务漏洞。如果Asterisk所接收到的报文声明长度为0到3之间，之后为所声明长度+ 4或更多字节，则由于超长的memcpy可能会导致出现分段错误。 Asterisk在RTP栈的STUN实现中存在拒绝服务漏洞。如果Asterisk在活动的RTP端口上接收到了特制的STUN报文的话，指针就可能超过可访问的内存。负责解析入站STUN报文的代码无法确认表示STUN属性的长度和STUN属性头大小是否超过了可用的数据，因此数据指针可能超过可访问的内存，导致崩溃。成功攻击要求启用了chan_sip、chan_gtalk、chan_jingle、chan_h323、chan_mgcp或chan_skinny。 Asterisk Asterisk 1.4.x Asterisk Asterisk 1.2.x Asterisk Asterisk 1.0.x Asterisk Business Edition B.x.x Asterisk Business Edition A.x.x Asterisk AsteriskNOW < beta7 Asterisk Appliance Developer Kit 0.x.x Asterisk s800i 1.0.x 临时解决方法： * 向/etc/asterisk/modules.conf中添加noload => chan_skinny.so，然后重启Asterisk。 厂商补丁： Asterisk -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href="ftp://ftp.digium.com/pub/telephony/asterisk" target="_blank">ftp://ftp.digium.com/pub/telephony/asterisk</a> <a href="http://www.asterisknow.org/" target="_blank">http://www.asterisknow.org/</a> <a href="ftp://ftp.digium.com/pub/telephony/aadk/" target="_blank">ftp://ftp.digium.com/pub/telephony/aadk/</a> |
| id | SSV:2027 |
| last seen | 2017-11-19 |
| modified | 2007-07-20 |
| published | 2007-07-20 |
| reporter | Root |
| title | Asterisk多个远程拒绝服务漏洞 |
References
- http://ftp.digium.com/pub/asa/ASA-2007-017.pdf
- http://ftp.digium.com/pub/asa/ASA-2007-017.pdf
- http://secunia.com/advisories/26099
- http://secunia.com/advisories/26099
- http://www.securityfocus.com/bid/24950
- http://www.securityfocus.com/bid/24950
- http://www.securitytracker.com/id?1018407
- http://www.securitytracker.com/id?1018407
- http://www.vupen.com/english/advisories/2007/2563
- http://www.vupen.com/english/advisories/2007/2563
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35480
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35480