asterisk: CVE-2017-17850: Crash in PJSIP resource when missing a contact header

Debian Bug report logs - #885072
asterisk: CVE-2017-17850: Crash in PJSIP resource when missing a contact header

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: asterisk: CVE-2017-17850: Crash in PJSIP resource when missing a contact header

Date: Sat, 23 Dec 2017 14:59:33 +0100

Source: asterisk
Version: 1:13.18.3~dfsg-1
Severity: grave
Tags: patch security upstream
Forwarded: https://issues.asterisk.org/jira/browse/ASTERISK-27480 

Hi,

the following vulnerability was published for asterisk.

CVE-2017-17850[0]:
| An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and
| older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP
| messages create a dialog in Asterisk. Those SIP messages must contain a
| contact header. For those messages, if the header was not present and
| the PJSIP channel driver was used, Asterisk would crash. The severity
| of this vulnerability is somewhat mitigated if authentication is
| enabled. If authentication is enabled, a user would have to first be
| authorized before reaching the crash point.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-17850
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17850
[1] https://issues.asterisk.org/jira/browse/ASTERISK-27480
[2] http://downloads.asterisk.org/pub/security/AST-2017-014.html

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 885072@bugs.debian.org (full text, mbox, reply):

From: Bernhard Schmidt <berni@birkenwald.de>

To: Salvatore Bonaccorso <carnil@debian.org>, 885072@bugs.debian.org

Subject: Re: Bug#885072: asterisk: CVE-2017-17850: Crash in PJSIP resource when missing a contact header

Date: Wed, 27 Dec 2017 22:57:31 +0100

Control: found -1 1:13.17.0~dfsg-1

Hi,

> CVE-2017-17850[0]:
> | An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and
> | older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP
> | messages create a dialog in Asterisk. Those SIP messages must contain a
> | contact header. For those messages, if the header was not present and
> | the PJSIP channel driver was used, Asterisk would crash. The severity
> | of this vulnerability is somewhat mitigated if authentication is
> | enabled. If authentication is enabled, a user would have to first be
> | authorized before reaching the crash point.
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2017-17850
>     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17850
> [1] https://issues.asterisk.org/jira/browse/ASTERISK-27480
> [2] http://downloads.asterisk.org/pub/security/AST-2017-014.html
> 
> Please adjust the affected versions in the BTS as needed.

Tzafrir has checked the code, part of it was introduced in 13.15.0 and
part in 13.18.0. So 1:13.17.0~dfsg-1 was the first Debian release
including the vulnerability.

Bernhard

Message #17 received at 885072-close@bugs.debian.org (full text, mbox, reply):

From: Tzafrir Cohen <tzafrir@debian.org>

To: 885072-close@bugs.debian.org

Subject: Bug#885072: fixed in asterisk 1:13.18.5~dfsg-1

Date: Wed, 27 Dec 2017 23:04:56 +0000

Source: asterisk
Source-Version: 1:13.18.5~dfsg-1

We believe that the bug you reported is fixed in the latest version of
asterisk, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 885072@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Tzafrir Cohen <tzafrir@debian.org> (supplier of updated asterisk package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 28 Dec 2017 00:20:16 +0200
Source: asterisk
Binary: asterisk asterisk-modules asterisk-dahdi asterisk-vpb asterisk-voicemail asterisk-voicemail-imapstorage asterisk-voicemail-odbcstorage asterisk-ooh423 asterisk-mp3 asterisk-mysql asterisk-mobile asterisk-tests asterisk-doc asterisk-dev asterisk-config
Architecture: source all amd64
Version: 1:13.18.5~dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian VoIP Team <pkg-voip-maintainers@lists.alioth.debian.org>
Changed-By: Tzafrir Cohen <tzafrir@debian.org>
Description:
 asterisk   - Open Source Private Branch Exchange (PBX)
 asterisk-config - Configuration files for Asterisk
 asterisk-dahdi - DAHDI devices support for the Asterisk PBX
 asterisk-dev - Development files for Asterisk
 asterisk-doc - Source code documentation for Asterisk
 asterisk-mobile - Bluetooth phone support for the Asterisk PBX
 asterisk-modules - loadable modules for the Asterisk PBX
 asterisk-mp3 - MP3 playback support for the Asterisk PBX
 asterisk-mysql - MySQL database protocol support for the Asterisk PBX
 asterisk-ooh423 - H.323 protocol support for the Asterisk PBX - ooH323c
 asterisk-tests - internal test modules of the Asterisk PBX
 asterisk-voicemail - simple voicemail support for the Asterisk PBX
 asterisk-voicemail-imapstorage - IMAP voicemail storage support for the Asterisk PBX
 asterisk-voicemail-odbcstorage - ODBC voicemail storage support for the Asterisk PBX
 asterisk-vpb - VoiceTronix devices support for the Asterisk PBX
Closes: 885072
Changes:
 asterisk (1:13.18.5~dfsg-1) unstable; urgency=medium
 .
   * New upstream release:
     - CVE-2017-17850 / AST-2017-014 (closes: #885072)
     - AST-2017-012: Remote Crash Vulnerability in RTCP Stack
   * Re-add support for snmp (Closes #851738)
   * Don't load dundi, mgcp, skinny and unistim by default
   * Avoid parallel build in 'make install'
   * tests: realpath is now in coreutils
   * asttestmods: enable res_pjsip_pubsub tests
   * asttestmods: run asterisk as user asterisk
   * asttestmods: disable module test_cel for now
Checksums-Sha1:
 b95a68b71a90de3aee1fd856c8b4106523f9f7a2 4047 asterisk_13.18.5~dfsg-1.dsc
 40274a8cbb8c588d03f0ac61fc04f8ae3e5f1c95 6275580 asterisk_13.18.5~dfsg.orig.tar.xz
 9a796717f3870a81c26a2bf466ef78d83c0dcf5a 329368 asterisk_13.18.5~dfsg-1.debian.tar.xz
 7f11e2ee5ca875093f63559ba6cf5d501c638939 1215784 asterisk-config_13.18.5~dfsg-1_all.deb
 27428f7822d5f728bf657606ed0dbe3f271c15e5 555944 asterisk-dahdi-dbgsym_13.18.5~dfsg-1_amd64.deb
 c6fcf7b51096a06bbec552310279a326562ebd02 1055004 asterisk-dahdi_13.18.5~dfsg-1_amd64.deb
 2f3fefb1092a8b01d47bfec2eb540e37ea38b2f8 3359180 asterisk-dbgsym_13.18.5~dfsg-1_amd64.deb
 5b274bba10b78cb7749024a8a4569832d239264c 1248204 asterisk-dev_13.18.5~dfsg-1_all.deb
 11a03604369c57b4339de570fd7253e2392dfc40 1561400 asterisk-doc_13.18.5~dfsg-1_all.deb
 47ffc37684db8a48078ce099c549e559bd609305 71472 asterisk-mobile-dbgsym_13.18.5~dfsg-1_amd64.deb
 a9b98e0738ae5b470350763ebd17e425e005113d 846708 asterisk-mobile_13.18.5~dfsg-1_amd64.deb
 8e85de04136cc73b372f6da2b93bba688bce94a9 9146504 asterisk-modules-dbgsym_13.18.5~dfsg-1_amd64.deb
 2f5c247f0fb33bab76ce1469ae1f45bc50a7c927 3112808 asterisk-modules_13.18.5~dfsg-1_amd64.deb
 9199b599873195a89f4cce7756da3e6f82a097ef 44556 asterisk-mp3-dbgsym_13.18.5~dfsg-1_amd64.deb
 c4fc3b1bf8f9547e7ac04e49dbbf90daf023a4eb 833884 asterisk-mp3_13.18.5~dfsg-1_amd64.deb
 bc377bbfeb4ef3145f5321630a5c65384f56b1c9 113816 asterisk-mysql-dbgsym_13.18.5~dfsg-1_amd64.deb
 477d44b63090e9e3412df1b8df3337cbff9d7055 850352 asterisk-mysql_13.18.5~dfsg-1_amd64.deb
 f41ae06cfc86a6dcbe363dc44e79a95511a30b76 1403516 asterisk-ooh423-dbgsym_13.18.5~dfsg-1_amd64.deb
 94c644f4e7c51908a8fae37520bff6415a46b57b 1149256 asterisk-ooh423_13.18.5~dfsg-1_amd64.deb
 c31ccf2014c535393dd5316aacadd67838282b2e 1164492 asterisk-tests-dbgsym_13.18.5~dfsg-1_amd64.deb
 c6fdd4a15d3649d0866ac2fea7b8a61f3d9f6ac4 1172416 asterisk-tests_13.18.5~dfsg-1_amd64.deb
 33c65655a7a14bdcd2be29d49e7dfabb1b48d185 222188 asterisk-voicemail-dbgsym_13.18.5~dfsg-1_amd64.deb
 59677b98e7b3954d5be0e1635b2dab3af44b131b 260216 asterisk-voicemail-imapstorage-dbgsym_13.18.5~dfsg-1_amd64.deb
 4c9b3721c9082164d34cf5f238a56e90353dee5d 923904 asterisk-voicemail-imapstorage_13.18.5~dfsg-1_amd64.deb
 c6448ee87195d703f9d5b3f94d2bfff9ba286727 233456 asterisk-voicemail-odbcstorage-dbgsym_13.18.5~dfsg-1_amd64.deb
 86a779b11eb88fa76e7300efb88f2c1a771259fc 912432 asterisk-voicemail-odbcstorage_13.18.5~dfsg-1_amd64.deb
 226e5d0bfb06b1e804f887e50b4d88dd3a73828c 906616 asterisk-voicemail_13.18.5~dfsg-1_amd64.deb
 bbd6e236d853fac5e5cdd734bf2eb65635ee8df5 66152 asterisk-vpb-dbgsym_13.18.5~dfsg-1_amd64.deb
 56dadf434be82d1ca603c85123f29b87fbfa151d 837352 asterisk-vpb_13.18.5~dfsg-1_amd64.deb
 33b5386171ef1fc441187a46424ac8dd2178a650 27732 asterisk_13.18.5~dfsg-1_amd64.buildinfo
 9f258893b8b5be2dba24059a9cea0ec7f68c9e39 2341028 asterisk_13.18.5~dfsg-1_amd64.deb
Checksums-Sha256:
 0976a91c2f941d8bf5cd7f094c5aa66e21e143e40277dee311101ec9c6d25412 4047 asterisk_13.18.5~dfsg-1.dsc
 c5bab7ae9bf25298eede9035708841043664bea0ad253a7fba452a1f7cfc6790 6275580 asterisk_13.18.5~dfsg.orig.tar.xz
 2f8b83e49ff68ac08b2c8389d222f138eb3ecec6d2b151b184b21625eb95ee90 329368 asterisk_13.18.5~dfsg-1.debian.tar.xz
 f77090737fed31142269efd9ca7d2b47de196d934b14ed8c949938ec1e9e2c25 1215784 asterisk-config_13.18.5~dfsg-1_all.deb
 02211c30d6b9203c6078f9efb247f43ff7c32da26cdc6671cc9acca01f34d811 555944 asterisk-dahdi-dbgsym_13.18.5~dfsg-1_amd64.deb
 d4f1eb7427fb8bb0a86d4497d2c1fe12652bb98a6b5bfd1fa54f2a6b590e1617 1055004 asterisk-dahdi_13.18.5~dfsg-1_amd64.deb
 d3b69aef606c8cdf2465ec85befc3897c3971bd265712111fda1482061453335 3359180 asterisk-dbgsym_13.18.5~dfsg-1_amd64.deb
 2ecf4fb278edd0704cd684ceed770762e1d6fb4dc9c26bb9510948a4c6d22e6d 1248204 asterisk-dev_13.18.5~dfsg-1_all.deb
 aa75b9912eccf22aaba2dbd11ec3cca1ad5950d7f0e508645a880156847df29d 1561400 asterisk-doc_13.18.5~dfsg-1_all.deb
 4163be53c4137a995d5e6cdfbf19cf2ac9710c8594bd85fa5e4aa0335be9f8af 71472 asterisk-mobile-dbgsym_13.18.5~dfsg-1_amd64.deb
 a5c8561f06bfd98af704de64e013d1c48335a162abff743f0ea105fcf6128d12 846708 asterisk-mobile_13.18.5~dfsg-1_amd64.deb
 8235d8cc48629d62c3cd9e95f623f400ddb6401425e2a1cb65b5d5ecdcb4afc9 9146504 asterisk-modules-dbgsym_13.18.5~dfsg-1_amd64.deb
 6f63fc107b1cf641dc953559a054c8c15238e6fda3fe24a8182b03ca999d01c1 3112808 asterisk-modules_13.18.5~dfsg-1_amd64.deb
 d8873d10dd591b8b96b8ee60ca579b1001b7fbf2b5433d2fdf4a18dc6cabdbba 44556 asterisk-mp3-dbgsym_13.18.5~dfsg-1_amd64.deb
 36e79dc7e9a2413f5148e3115f1a448ce2d794509a8d78ae2d3cd90bbd3d1d01 833884 asterisk-mp3_13.18.5~dfsg-1_amd64.deb
 0125b2765b34b8cdd622c22ed1faf9abab3956846eeaaadcd1245671d882fe6f 113816 asterisk-mysql-dbgsym_13.18.5~dfsg-1_amd64.deb
 5e051d3a4a891541caf06a2b1b9c0e7f8758330dcab68f221820ac3ecf98635c 850352 asterisk-mysql_13.18.5~dfsg-1_amd64.deb
 f574f3d06d6f855e5e2db1a476e7ab13dc896d49476510988c5c23f9d5ebc4df 1403516 asterisk-ooh423-dbgsym_13.18.5~dfsg-1_amd64.deb
 56528d65f15fe3a43b366eed6682840ce96d60854b37dac4a3fbfa12b943c233 1149256 asterisk-ooh423_13.18.5~dfsg-1_amd64.deb
 cd365e86654f6fbacf6f7405e424f9d66440fb48e2b39b9c4bcc594c8e3ae551 1164492 asterisk-tests-dbgsym_13.18.5~dfsg-1_amd64.deb
 21e63190280fa12eb1379196189c6cccb26b7b1caeab3e2ef8e2f0a568b0bf69 1172416 asterisk-tests_13.18.5~dfsg-1_amd64.deb
 a941d8ed81e3cd4b817407633d0ce51b266468405d73aeca947e65068e9b72fb 222188 asterisk-voicemail-dbgsym_13.18.5~dfsg-1_amd64.deb
 24052f410012430028b02dbacb4f385995cbfb55cc6ae51d71ec1588ac269eee 260216 asterisk-voicemail-imapstorage-dbgsym_13.18.5~dfsg-1_amd64.deb
 f43696037ac991967d76aa445005303177fbe5701ba39550ee9db5b46101852c 923904 asterisk-voicemail-imapstorage_13.18.5~dfsg-1_amd64.deb
 cf62044cc9ee9bc41f6d5d5ad585785a42745d5e9c3ff0fb16c795e75fa98e08 233456 asterisk-voicemail-odbcstorage-dbgsym_13.18.5~dfsg-1_amd64.deb
 7740047baf9ae780b614e031384d8bc90e9c89f0f8e3394a688e1ebde1a1ac84 912432 asterisk-voicemail-odbcstorage_13.18.5~dfsg-1_amd64.deb
 5f61a7839729e40dd15fd1360deabbe12546fa08793d96ea2f1b550460cd7c47 906616 asterisk-voicemail_13.18.5~dfsg-1_amd64.deb
 100e53ff47ea10ad01a2e9cd45ee16a7bb575f3fd93974fc587dccb720e1e2d9 66152 asterisk-vpb-dbgsym_13.18.5~dfsg-1_amd64.deb
 ec54b8465bc715af57179033bfaeeae7723b8da974a878766d9490a5f7c46304 837352 asterisk-vpb_13.18.5~dfsg-1_amd64.deb
 1bf1e401775fb1025880827545bc4524518b9ea493ccdf3e9b8fedc30b670271 27732 asterisk_13.18.5~dfsg-1_amd64.buildinfo
 c95bbdab2b1391891b199aea12c8578ff236ad66104047770ac8e37b5ee3a983 2341028 asterisk_13.18.5~dfsg-1_amd64.deb
Files:
 fe5566408cd9b1777eb98a596ed68988 4047 comm optional asterisk_13.18.5~dfsg-1.dsc
 2fc3092abdaeeacc2d99873b7ee3cdbd 6275580 comm optional asterisk_13.18.5~dfsg.orig.tar.xz
 a702c214472682babc7e8d38bd15ffde 329368 comm optional asterisk_13.18.5~dfsg-1.debian.tar.xz
 80a65be96d29c3eb7361e83019d298d3 1215784 comm optional asterisk-config_13.18.5~dfsg-1_all.deb
 568737da6b03b44b7a257923abb433da 555944 debug optional asterisk-dahdi-dbgsym_13.18.5~dfsg-1_amd64.deb
 1c8993c21c436b7bb04789ae47bbe14c 1055004 comm optional asterisk-dahdi_13.18.5~dfsg-1_amd64.deb
 d55ae80028e0da8ebdac27e25326ce43 3359180 debug optional asterisk-dbgsym_13.18.5~dfsg-1_amd64.deb
 e175232f16bc0056c0acbf787fe57113 1248204 devel optional asterisk-dev_13.18.5~dfsg-1_all.deb
 6ea80c5149daaf0d95f4251e28ab5468 1561400 doc optional asterisk-doc_13.18.5~dfsg-1_all.deb
 da429c39347733dee2533ae4831e7c53 71472 debug optional asterisk-mobile-dbgsym_13.18.5~dfsg-1_amd64.deb
 96097c578acbe5ad889b2a484e62cf2b 846708 comm optional asterisk-mobile_13.18.5~dfsg-1_amd64.deb
 ed93d8d165de574976fa19b589ced2bc 9146504 debug optional asterisk-modules-dbgsym_13.18.5~dfsg-1_amd64.deb
 15b94af6c0d6b9fd484b4ee897742a32 3112808 libs optional asterisk-modules_13.18.5~dfsg-1_amd64.deb
 e0606b7757d2e10896dfb165b3578a2f 44556 debug optional asterisk-mp3-dbgsym_13.18.5~dfsg-1_amd64.deb
 51d9a083a240421733854c4cb7bb2267 833884 comm optional asterisk-mp3_13.18.5~dfsg-1_amd64.deb
 bd6c5d8a8542938afe1bfd5196759017 113816 debug optional asterisk-mysql-dbgsym_13.18.5~dfsg-1_amd64.deb
 38e79590d49fbcd7fe94acd9767f3245 850352 comm optional asterisk-mysql_13.18.5~dfsg-1_amd64.deb
 269c418780d841cd01afe46bd6d4d8d1 1403516 debug optional asterisk-ooh423-dbgsym_13.18.5~dfsg-1_amd64.deb
 229d6b8d1935363e45cdcd2eab1649cc 1149256 comm optional asterisk-ooh423_13.18.5~dfsg-1_amd64.deb
 557d4a02870cc3775fcaaa4746a3a108 1164492 debug optional asterisk-tests-dbgsym_13.18.5~dfsg-1_amd64.deb
 2d04fba638c4d0d992a550df7349081c 1172416 comm optional asterisk-tests_13.18.5~dfsg-1_amd64.deb
 8a99a9fbc08df9451d8124d09c4ceed9 222188 debug optional asterisk-voicemail-dbgsym_13.18.5~dfsg-1_amd64.deb
 c841374ecc6c5dc3040fdf5880544b87 260216 debug optional asterisk-voicemail-imapstorage-dbgsym_13.18.5~dfsg-1_amd64.deb
 e34c17591ae3721151c3f4ea3485ec88 923904 comm optional asterisk-voicemail-imapstorage_13.18.5~dfsg-1_amd64.deb
 14abd951cea4e7512969199e5b8bb2d9 233456 debug optional asterisk-voicemail-odbcstorage-dbgsym_13.18.5~dfsg-1_amd64.deb
 a7665ede0b5d394b0fa936efccb9ab4f 912432 comm optional asterisk-voicemail-odbcstorage_13.18.5~dfsg-1_amd64.deb
 6cfa3947b311228c9fd2155565ad782d 906616 comm optional asterisk-voicemail_13.18.5~dfsg-1_amd64.deb
 f5158ddea9a0560fcbc289a0be695f20 66152 debug optional asterisk-vpb-dbgsym_13.18.5~dfsg-1_amd64.deb
 3dd54ee56e74235fda37ca36acbafe0d 837352 comm optional asterisk-vpb_13.18.5~dfsg-1_amd64.deb
 ab2f2b79f6bfee0caf4bd410f2bf6efd 27732 comm optional asterisk_13.18.5~dfsg-1_amd64.buildinfo
 7ca4f886727672768664355547effae5 2341028 comm optional asterisk_13.18.5~dfsg-1_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEjhGGa0mM+W3ykQJyjv1MLwMloM4FAlpEIEMACgkQjv1MLwMl
oM6F5AwAkCRu2e8LeGsC4pI5Uydnq/bTuUlUTp8TIV72cL7wnvONnu9TW9QqidjR
NFbQ94/kCM3EGkkmgFmc0ZFr2HmBY4MGMxiZ3FLF9yc31qoNTyl1sk0mDgJ66JY1
P1Ysm67w2/jBO539m/O64FT0hYXuHYz7W6i27XYz15ONPRP5lBJqSLmdCMpmtkF+
iQDjdmb5LpYjAzaxY99FyGrZ7/mN/YZaTJMvQhwiiFMYGSSaWpOIqxPXRHRuSZTs
RD5uyASyvOSNwNI8a13N3rC1gRvQKLwKI/BqAHWfKMXlvq0/k4kDfxQYNrnZyUAQ
REJZwLuoq9g3jWUvt95oLOMeipUKH+mhoOrJfzERHkEfqNkxSxQcEq+mjAOhT0AH
07bTL5bRaJMEiahrjenX7vXXLsEPE4nopVev8SIydj0p/4gAc4rtN20J3/iUgADV
GUgs+y2k835DC6crASYI+G06qDfrgk66T/6iq3TfSduepNvRT94iom83HBRvZ3iQ
g59N87Tp
=/9Tq
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.