asterisk: CVE-2017-16672: AST-2017-011: Memory/File Descriptor/RTP leak in pjsip session resource

Debian Bug report logs - #881256
asterisk: CVE-2017-16672: AST-2017-011: Memory/File Descriptor/RTP leak in pjsip session resource

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: asterisk: CVE-2017-16672: AST-2017-011: Memory/File Descriptor/RTP leak in pjsip session resource

Date: Thu, 09 Nov 2017 13:54:34 +0100

Source: asterisk
Version: 1:13.17.2~dfsg-1
Severity: important
Tags: patch security upstream
Forwarded: https://issues.asterisk.org/jira/browse/ASTERISK-27345

Hi,

the following vulnerability was published for asterisk.

CVE-2017-16672[0]:
| An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14
| before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before
| 13.13-cert7. A memory leak occurs when an Asterisk pjsip session object
| is created and that call gets rejected before the session itself is
| fully established. When this happens the session object never gets
| destroyed. Eventually Asterisk can run out of memory and crash.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-16672
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16672
[1] https://issues.asterisk.org/jira/browse/ASTERISK-27345
[2] http://downloads.digium.com/pub/security/AST-2017-011.html

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 881256-close@bugs.debian.org (full text, mbox, reply):

From: Bernhard Schmidt <berni@debian.org>

To: 881256-close@bugs.debian.org

Subject: Bug#881256: fixed in asterisk 1:13.18.1~dfsg-1

Date: Thu, 09 Nov 2017 23:19:16 +0000

Source: asterisk
Source-Version: 1:13.18.1~dfsg-1

We believe that the bug you reported is fixed in the latest version of
asterisk, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 881256@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bernhard Schmidt <berni@debian.org> (supplier of updated asterisk package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 09 Nov 2017 23:35:12 +0100
Source: asterisk
Binary: asterisk asterisk-modules asterisk-dahdi asterisk-vpb asterisk-voicemail asterisk-voicemail-imapstorage asterisk-voicemail-odbcstorage asterisk-ooh423 asterisk-mp3 asterisk-mysql asterisk-mobile asterisk-tests asterisk-doc asterisk-dev asterisk-config
Architecture: source
Version: 1:13.18.1~dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian VoIP Team <pkg-voip-maintainers@lists.alioth.debian.org>
Changed-By: Bernhard Schmidt <berni@debian.org>
Description:
 asterisk   - Open Source Private Branch Exchange (PBX)
 asterisk-config - Configuration files for Asterisk
 asterisk-dahdi - DAHDI devices support for the Asterisk PBX
 asterisk-dev - Development files for Asterisk
 asterisk-doc - Source code documentation for Asterisk
 asterisk-mobile - Bluetooth phone support for the Asterisk PBX
 asterisk-modules - loadable modules for the Asterisk PBX
 asterisk-mp3 - MP3 playback support for the Asterisk PBX
 asterisk-mysql - MySQL database protocol support for the Asterisk PBX
 asterisk-ooh423 - H.323 protocol support for the Asterisk PBX - ooH323c
 asterisk-tests - internal test modules of the Asterisk PBX
 asterisk-voicemail - simple voicemail support for the Asterisk PBX
 asterisk-voicemail-imapstorage - IMAP voicemail storage support for the Asterisk PBX
 asterisk-voicemail-odbcstorage - ODBC voicemail storage support for the Asterisk PBX
 asterisk-vpb - VoiceTronix devices support for the Asterisk PBX
Closes: 881256 881257
Changes:
 asterisk (1:13.18.1~dfsg-1) unstable; urgency=medium
 .
   * New upstream version 13.18.1~dfsg
     - CVE-2017-16671 / AST-2017-010
       Buffer overflow in CDR's set user (Closes: #881257)
     - CVE-2017-16672 / AST-2017-011
       Memory/File Descriptor/RTP leak in pjsip session resource
       (Closes: #881256)
     - Drop gmime-3.x and srtp 2.1 support patches applied upstream
     - Drop pjsip_unresolved_symbol.patch applied upstream
   * reproducibility: Sort order of input files for core-en_US.xml generation
   * Drop dh --with autotools_dev, default in compat 10
   * Add Multi-Arch: foreign to -dev and -doc
   * Remove deprecated priority extra
Checksums-Sha1:
 720b9b0942f0ac1542af04656cc2b9a3ab2477f7 4243 asterisk_13.18.1~dfsg-1.dsc
 cf18d3f5db478ba507fa83d7bec755e08f518ac9 6273880 asterisk_13.18.1~dfsg.orig.tar.xz
 949e767e04eb73aea3ccdc49c9259dff08e8f1f2 168648 asterisk_13.18.1~dfsg-1.debian.tar.xz
 52035b8d203ad9dfe413da8912d85a61ef098c7f 27311 asterisk_13.18.1~dfsg-1_amd64.buildinfo
Checksums-Sha256:
 797c8b2eef7bfa28c48b057a10a67490f82bfa80927ddce17669d90bb95b3a23 4243 asterisk_13.18.1~dfsg-1.dsc
 574a10561bdc35f9a38468fcf2b2c32b9b78a1724a9ffac61639af6cd572e2ef 6273880 asterisk_13.18.1~dfsg.orig.tar.xz
 eca0e7a87ba0431cf80bf25aa44f42ae57a2b5e17bcd13945bbbcf5e0611d420 168648 asterisk_13.18.1~dfsg-1.debian.tar.xz
 838225635e3275aa8334ebfaa731ca8443434ae609687baffcd985180ae0e3e2 27311 asterisk_13.18.1~dfsg-1_amd64.buildinfo
Files:
 3bcbf288e7b07771a803de8965727dfd 4243 comm optional asterisk_13.18.1~dfsg-1.dsc
 54535824a6655c65caee94999a426ecc 6273880 comm optional asterisk_13.18.1~dfsg.orig.tar.xz
 b4a4acceb4f229c335ade2bf8471552b 168648 comm optional asterisk_13.18.1~dfsg-1.debian.tar.xz
 6f865696cc375fafa18fe2c393d319ed 27311 comm optional asterisk_13.18.1~dfsg-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJFBAEBCAAvFiEE1uAexRal3873GVbTd1B55bhQvJMFAloE3Y8RHGJlcm5pQGRl
Ymlhbi5vcmcACgkQd1B55bhQvJOW8BAAqrXqhxDLVy+30/3RE1vlYSlVgVhxmsoS
vFEf9G1IiEqNvERU1jK5lk6U55vG4LIx9JaNtXOubtlUldmWyhg7PMW124f4ptjA
vbMe5ogTjxIArpSO0WafHlKEFUtWTt1TGDmCjZN/m8snGdRY2+bMi8Pj05J7cGeb
Q6Si+182fJ+T5O/WCjDupGOgq1iYmuv8JQSi4DxQu1GXXjIFpjTNyT4LUYDKkdvJ
ICWTQ9t2wTBpBL1Y17T4Y0jmAzbmaAr9MPwBjoFTnPKr+9UU2xYqYs57+fJFbGH+
1BMp4WV4Aje+ea4D5nbOiU4xgXH6UhKFr8PNHgZIpJJYvECOnf9Zn+DGtY4mmStj
rJ3ITabFg+FCuTY3nrQHyAm7ETRFdnfXs5SR4kzVkPJ/UIitdvBhN6vWwjx2IzTQ
NIZLOuCzXM93zZ40YdKYPwBe/Y1F/swTcpxfQ6V9BAW0RxdU6zHG4J8xMe9DJXFe
8dx67QqEKDQ6171/Q6xice994B+kGhaJ/BHX3r1WOhsKnpB3qxT7m0MTtMeyYn6H
zfNOFtKSLuohfBlFUIAPmz9+4nwahEgEiSB/cMb1io7VJcIFVU4YSKNP8biNX81T
EcLkdfgfC4FagqETD+Lt439vLkCNJHOKW+78q88JtrGnwY2Hx3G3I4F1ElnFb3Qz
Z/Q1uqJNtnI=
=65Ba
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.