AST-2018-007: Infinite loop when reading iostreams
When connected to Asterisk via TCP/TLS if the client abruptly
disconnects, or sends a specially crafted message then Asterisk
gets caught in an infinite loop while trying to read the data stream.
Thus rendering the system as unusable.
AST-2018-008: PJSIP endpoint presence disclosure when using ACL
When endpoint specific ACL rules block a SIP request they respond with
a 403 forbidden. However, if an endpoint is not identified then a 401
unauthorized response is sent. This vulnerability just discloses which
requests hit a defined endpoint. The ACL rules cannot be bypassed to
gain access to the disclosed endpoints.
handling From:
- fix berkeley db utilities and kamctl "shift: nothing to shift",
reported by feinerer@, from maintainer Roman Kravchuk
- fix runtime TLS failure, undefined symbol OPENSSL_zalloc,
from maintainer
- remove some dead patches follow switch to clang, from me
(there was an earlier update to 5.1.x from maintainer earlier this
month which I missed pushing earlier and it's too close to release now;
this is planned for post-6.3)
fail, reported by naddy@.
set COMPILER_LANGS=c while there, the GNU compiler is only used for C nested
functions (because I still have no ideas about the BlocksRuntime with clang),
c++ is not needed.
AST-2018-002: Crash when given an invalid SDP media format description
AST-2018-003: Crash with an invalid SDP fmtp attribute
AST-2018-004: Crash when receiving SUBSCRIBE request
AST-2018-005: Crash when large numbers of TCP connections are closed suddenly
AST-2018-006: WebSocket frames with 0 sized payload causes DoS
(only 15.x reported as affected by AST-2018-001)
BIO_meth_set_callback_ctrl(). however in this case it is just setting the
callback pointer to NULL, and BIO_meth_new() already returns zeroed space,
so just skip that for now.
Fix #! line for bash in astversion. Not forced in RUN_DEPENDS because in all
the time this has been present only one person noticed, so the script doesn't
seem too popular. (Script also makes some assumptions about library versions
which don't apply here but I don't think it's worth poking at this too far).
Reported by landry@
(other codecs are already disabled in the pjproject build, it's only used for sip
signalling - asterisk has its own codec stack, this doesn't affect use of the
asterisk-g729 package).
AST-2017-012: Remote Crash Vulnerability in RTCP Stack
If a compound RTCP packet is received containing more than one report
(for example a Receiver Report and a Sender Report) the RTCP stack
will incorrectly store report information outside of allocated memory
potentially causing a crash.
AST-2017-014: Crash in PJSIP resource when missing a contact header
A select set of SIP messages create a dialog in Asterisk. Those SIP
messages must contain a contact header. For those messages, if the
header was not present and using the PJSIP channel driver, it would
cause Asterisk to crash. The severity of this vulnerability is somewhat
mitigated if authentication is enabled. If authentication is enabled a
user would have to first be authorized before reaching the crash point.
