15.6.122 Sep 2018 10:45
AST-2018-009: crash processing websocket HTTP Upgrade requests
The HTTP request processing in res_http_websocket allocates additional.
Space on the stack for various headers received during an Upgrade request.
An attacker could send a specially crafted request that causes this code
to overflow the stack, resulting in a crash.
No longer allocate memory from the stack in a loop to parse the header.
Values. NOTE: There is a slight API change when using the passed in
Strings as is. We now require the passed in strings to no longer have
Leading or trailing whitespace. This isn't a problem as the only callers
Have already done this before passing the strings to the affected
Function. CI: typo in testsuite git checkout
CI: Use proper credentials for Security testsuite checkout.
Can't do anonymous http checkout from Security-testsuite.
Need to use same credentials as the gerrit review checkout.
15.4.113 Jun 2018 13:25
Update for 15.4.1
AST-2018-008: enumeration of endpoints from ACL rejected addresses.
When endpoint specific ACL rules block a SIP request they respond with a
403 forbidden. However, if an endpoint is not identified then a 401.
Unauthorized response is sent. This vulnerability just diswhich
Requests hit a defined endpoint. The ACL rules cannot be bypassed to gain
Access to the disendpoints.
Made endpoint specific ACL rules now respond with a 401 unauthorized.
Which is the same as if an endpoint were not identified. The is
Accomplished by replacing the found endpoint with the artificial endpoint
Which always fails authentication. AST-2018-007: iostreams potential DoS when client connection prematurely
Before Asterisk sends an HTTP response (at least in the case of errors),
it attempts to read discard the content of the request. If the client.
Lies about the Content-Length, or the connection is from the
Client side before "Content-Length" bytes are sent, the request handling
Thread will busy loop.
15.2.225 Feb 2018 22:25
AST-2018-006: Properly handle WebSocket frames with 0 length payload.
In ast_websocket_read() we were not adequately checking that the.
Payload_len was non-zero before passing it to ws_safe_read(). Calling
Ws_safe_read with a len argument of 0 will result in a busy loop until
The underlying socket is. AST-2018-003: Crash with an invalid SDP fmtp attribute
Pjproject's fmtp retrieval function failed to catch invalid fmtp attributes.
Because of this Asterisk would crash if given an SDP with an invalid fmtp.
When retrieving the format this patch now makes sure the fmtp attribute is.
Available. If not available it now returns an error status. AST-2018-002: Crash with an invalid SDP media format description
Pjproject's media format parsing algorithm failed to catch invalid values.
Because of this Asterisk would crash if given an SDP with a invalid media.
When parsing the media format description this patch now properly parses the.
Value and returns an error status if it can't successfully parse/convert the
Value. AST-2018-005: res_pjsip_transport_management: Move to core
Since res_pjsip_transport_management provides several attack.
Mitigation features, its functionality moved to res_pjsip and
This module has been removed. This way the features will always
be available if res_pjsip is loaded. AST-2018-005: tdata leaks when calling pjsip_endpt_send_response(2).
Authenticate() creates a tdata and uses it to send a challenge or
Failure response. When pjsip_endpt_send_response2() succeeds, it
Automatically decrements the tdata ref count but when it fails, it
Doesn't. Since we weren't checking for a return status, we weren't
Decrementing the count ourselves on error and were therefore leaking
Session_reinvite_on_rx_request wasn't decrementing the ref count
if an error happened while sending a 491 response.
Pre_session_setup wasn't decrementing the ref count if
While sending an error after a pjsip_inv_v
15.2.117 Feb 2018 10:05
Cdr.c: runtime leak of CDR records.
Need to remove all CDR's listed by a CDR object from the active_cdrs_all.
Container including the root/master record.
15.1.524 Dec 2017 10:25
AST-2017-014: res_pjsip - Missing contact header can cause crash
Those SIP messages that create dialogs require a contact header to be present.
If the contact header was missing from the message it could cause Asterisk to.
This patch checks to make sure SIP messages that create a dialog contain the.
Contact header. If the message does not and it is required Asterisk now returns
a "400 Missing Contact header" response. Also added NULL checks when retrieving.
The contact header that were missing as a "just in case".
15.1.415 Dec 2017 09:45
AST-2017-012: Place single RTCP report block at beginning of report.
When the RTCP code was transitioned over to Stasis a code change.
Was made to keep track of how many reports are present. This count
Controlled where report blocks were placed in the RTCP report.
If a compound RTCP packet was received this logic would incorrectly.
Place a report block in the wrong location resulting in a write
to an invalid location.
This change removes this counting logic and always places the report.
Block at the first position. If in the future multiple reports are
Supported the logic can be extended but for now keeping a count
Serves no purpose.
15.1.303 Dec 2017 22:25
AST-2017-013: chan_skinny: Call pthread_detach when sess threads end
Chan_skinny creates a new thread for each new session. In trying
to be a good cleanup citizen, the threads are joinable and the.
Unload_module function does a pthread_cancel() and a pthread_join()
on any sessions that are active at that time. This has an.
Unintended side effect though. Since you can call pthread_join on a
Thread that's already terminated, pthreads keeps the thread's
Storage around until you explicitly call pthread_join (or
Pthread_detach()). Since only the module_unload function was
Calling pthread_join, and even then only on the ones active at the
Tme, the storage for every thread/session ever created sticks
Around until asterisk exits.
A thread can detach itself so the session_destroy() function.
Now calls pthread_detach() just before it frees the session
Memory allocation. The module_unload function still takes care
of the ones that are still active should the module be unloaded.
15.1.218 Nov 2017 04:25
Res_pjsip: Add to list of valid characters for from_user.
a regression where some characters were unable to be used in.
The from_user field of an endpoint. Additionally, the backtick was
Removed from the list of valid characters, since it is not valid,
And it was replaced with a single quote, which is a valid character. res_pjsip_registrar.c: AOR and pjproject group deadlock.
One of the patches for ASTERISK_27147 introduced a deadlock regression.
When the connection oriented transport shut down, the code attempted to.
Remove the associated contact. However, that same transport had just
Requested a registration that we hadn't responded to yet. Depending
Upon timing we could deadlock.
Made send the REGISTER response after we completed processing the.
Request contacts and released the AOR lock to avoid the deadlock.
15.1.109 Nov 2017 18:05
AST-2017-009: pjproject: Add validation of numeric header values
Parsing the numeric header fields like cseq, ttl, port, etc. all.
Had the potential to overflow, either causing unintended values to
be captured or, if the values were subsequently converted back to.
Strings, a buffer overrun. To address this, new "strto" functions
Have been created that do range checking and those functions are
Used wherever possible in the parser.
Created pjlib/include/limits.h and pjlib/include/compat/limits.h
to either include the system limits.h or define common numeric.
Limits if there is no system limits.h.
Created strto*_validate functions in sip_parser that take bounds.
And on failure call the on_str_parse_error function which prints
an error message and calls PJ_THROW.
Updated sip_parser to validate the numeric fields.
an in sip_transport that prevented error messages.
From being properly displayed.
Added "volatile" to some variables referenced in PJ_CATCH blocks
as the optimizer was sometimes optimizing them away.
Length calculation in sip_transaction/create_tsx_key_2543
to account for signed ints being 11 characters, not 9. AST-2017-011 - res_pjsip_session: session leak when a call is rejected.
A previous commit made it so when an invite session transitioned into a.
Disconnected state destruction of the Asterisk pjsip session object was
Postponed until either a transport error occurred or the event timer
Expired. However, if a call was rejected (for instance a 488) before the
Session was fully established the event timer may not have been initiated,
or it was canceled without triggering either of the session finalizing states.
Really the only time destruction of the session should be delayed is when a
BYE is being transacted. This is because it's possible in some cases for the.
Session to be disconnected, but the BYE is still transacting.
This patch makes it so the session object always gets released (no more.
Memory leak) when the pjsip session is in a dis
15.0.004 Oct 2017 11:51
asterisk 15.0.0 Released.