[NEWS] Resource Exhaustion Vulnerability in Asterisk SIP Channel Driver

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Resource Exhaustion Vulnerability in Asterisk SIP Channel Driver
------------------------------------------------------------------------

SUMMARY

The handling of SIP dialog history was broken during the development of
Asterisk 1.4. Regardless of whether recording SIP dialog history is turned
on or off, the history is still recorded in memory. Furthermore, there is
no upper limit on how many history items will be stored for a given SIP
dialog. It is possible for an attacker to use up all of the system's
memory by creating a SIP dialog that records many entires in the history
and never ends. It is also worth noting for the sake of doing the math to
calculate what it would take to exploit this that each SIP history entry
will take up a maximum of 88 bytes.

DETAILS

Vulnerable Systems:
* Asterisk Open Source version 1.4.10 and prior
* AsteriskNOW pre-release beta6 and prior
* Asterisk Appliance Developer Kit versions prior to 0.8.0
* s800i (Asterisk Appliance) version 1.0.2

Immune Systems:
* Asterisk Open Source version 1.4.11
* AsteriskNOW pre-release beta7
* Asterisk Appliance Developer Kit version 0.8.0
* s800i (Asterisk Appliance) version 1.0.3

Resolution:
The fix that has been added to chan_sip is to restore the functionality
where SIP dialog history is not recorded in memory if it is not enabled.
Furthermore, a maximum of 50 entires in the history will be stored for
each dialog when recording history is turned on.

The only way to avoid this problem in affected versions of Asterisk is to
disable chan_sip. If chan_sip is being used, the system must be upgraded
to a version that has this issue resolved.

ADDITIONAL INFORMATION

The information has been provided by <mailto:security@asterisk.org>
Asterisk Security Team.
The original article can be found at:
<http://downloads.digium.com/pub/asa/AST-2007-020.html>

http://downloads.digium.com/pub/asa/AST-2007-020.html

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.