Package: asterisk
version: 1:1.4.21.2~dfsg-3
Severity: grave
Tags: patch
The Asterisk Project has issued the following advisory:
http://downloads.digium.com/pub/asa/AST-2009-003.html
It affects the versions in oldstable (1.2.13), stable/testing/unstable
(1.4.21) and experimental (1.6.1-rc3. rc4, fixing this should be
released shortly).
CVE entry: CVE-2008-3903
I'd like to include here the text of the advisory, as I believe it is
worth restating:
In 2006, the Asterisk maintainers made it more difficult to scan for
valid SIP usernames by implementing an option called
"alwaysauthreject", which should return a 401 error on all replies
which are generated for users which do not exist. While this was
sufficient at the time, due to ever increasing compliance with RFC
3261, the SIP specification, that is no longer sufficient as a means
towards preventing attackers from checking responses to verify whether
a SIP account exists on a machine.
What we have done is to carefully emulate exactly the same responses
throughout possible dialogs, which should prevent attackers from
gleaning this information. All invalid users, if this option is turned
on, will receive the same response throughout the dialog, as if a
username was valid, but the password was incorrect.
It is important to note several things. First, this vulnerability is
derived directly from the SIP specification, and it is a technical
violation of RFC 3261 (and subsequent RFCs, as of this date), for us
to return these responses. Second, this attack is made much more
difficult if administrators avoided creating all-numeric usernames and
especially all-numeric passwords. This combination is extremely
vulnerable for servers connected to the public Internet, even with
this patch in place. While it may make configuring SIP telephones
easier in the short term, it has the potential to cause grief over the
long term.
Patches are linked from the advisory and are now being tested.
--
Tzafrir Cohen
icq#16849755 jabber:tzafrir.co...@xorcom.com
+972-50-7952406 mailto:tzafrir.co...@xorcom.com
http://www.xorcom.com iax:gu...@local.xorcom.com/tzafrir
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
