To whom it may concern: I'm in need of a job, can anyone help me find employment in Illinois? -- -- LaFron D. Aldridge I do not seek to understand in order to believe; rather, I believe in order to understand. For I also believe this: that unless I believed, I would not understand. St. Anselm of Canterbury
Hi all, for anyone interested in future voip security related stuff, i would suggest to join the IETF Rtcweb mailing lists, as in recent months there are very challenging discussion on Security of WebRTC standard (Encrypted VoIP embedded in all future browsers). Subscription on https://www.ietf.org/mailman/listinfo/rtcweb -naif
VOIPSEC readers, Just testing the list as the archives do not appear to be working for the list. (And hey, giving you all a reminder that you are still on this list!Regards, Dan -- -- Dan York dyork <at> lodestar2.com Phone: +1-802-735-1624 skype:danyork http://www.danyork.com/ http://twitter.com/danyork
Asterisk Project Security Advisory - AST-2012-005
Product Asterisk
Summary Heap Buffer Overflow in Skinny Channel Driver
Nature of Advisory Exploitable Heap Buffer Overflow
Susceptibility Remote Authenticated Sessions
Severity Minor
Exploits Known No
Reported On March 26, 2012
Reported By Russell Bryant
Posted On April 23, 2012
Last Updated On April 23, 2012
Advisory Contact Matt Jordan < mjordan AT digium DOT com >
CVE Name
Description In the Skinny channel driver, KEYPAD_BUTTON_MESSAGE events
are queued for processing in a buffer allocated on the
heap, where each DTMF value that is received is placed on
the end of the buffer. Since the length of the buffer is
never checked, an attacker could send sufficient
KEYPAD_BUTTON_MESSAGE events such that the buffer is
overrun.
Resolution The length of the buffer is now checked before appending a
value to the end of the buffer.
Affected Versions
Product Release Series
Asterisk Open Source 1.6.2.x All Versions
Asterisk Open Source 1.8.x All Versions
(Continue reading)
Asterisk Project Security Advisory - AST-2012-006
Product Asterisk
Summary Remote Crash Vulnerability in SIP Channel Driver
Nature of Advisory Remote Crash
Susceptibility Remote Authenticated Sessions
Severity Moderate
Exploits Known No
Reported On April 16, 2012
Reported By Thomas Arimont
Posted On April 23, 2012
Last Updated On April 23, 2012
Advisory Contact Matt Jordan < mjordan AT digium DOT com >
CVE Name
Description A remotely exploitable crash vulnerability exists in the
SIP channel driver if a SIP UPDATE request is processed
within a particular window of time. For this to occur, the
following must take place:
1. The setting 'trustrpid' must be set to True
2. An UPDATE request must be received after a call has been
terminated and the associated channel object has been
destroyed, but before the SIP dialog associated with the
call has been destroyed. Receiving the UPDATE request
before the call is terminated or after the SIP dialog
associated with the call will not cause the crash
vulnerability described here.
(Continue reading)
Asterisk Project Security Advisory - AST-2012-004
Product Asterisk
Summary Asterisk Manager User Unauthorized Shell Access
Nature of Advisory Permission Escalation
Susceptibility Remote Authenticated Sessions
Severity Minor
Exploits Known No
Reported On February 23, 2011
Reported By David Woolley
Posted On April 23, 2012
Last Updated On April 23, 2012
Advisory Contact Jonathan Rose < jrose AT digium DOT com >
CVE Name
Description A user of the Asterisk Manager Interface can bypass a
security check and execute shell commands when they lack
permission to do so. Under normal conditions, a user should
only be able to run shell commands if that user has System
class authorization. Users could bypass this restriction by
using the MixMonitor application with the originate action
or by using either the GetVar or Status manager actions in
combination with the SHELL and EVAL functions. The patch
adds checks in each affected action to verify if a user has
System class authorization. If the user does not have those
authorizations, Asterisk rejects the action if it detects
the use of any functions or applications that run system
commands.
Resolution Asterisk now performs checks against manager commands that
(Continue reading)
How to Configure the New Call Blocking Asterisk Collector http://www.humbuglabs.org/blog/2012/03/20/how-to-configure-the-new-call-blocking-asterisk-collector/ Humbug Telecom Labs has released the Silver Hawk version of our collector for Asterisk based systems This new collector enables companies running Asterisk version 1.4 (or later) to benefit from Humbug’s fraud blocking service. The blocking is currently available for the following alerts: For Asterisk version 1.4 and up: - Business Hours - Time Range For Asterisk versions 1.6 and up: - Blacklist - Community Blacklist - Blacklist Country We will be expanding to cover all our alerts in the near future. For more details about the features in the latest release please see our blog about it <http://www.humbuglabs.org/blog/2012/02/26/introducing-the-silver-hawk/>. Essentially, when a call is made from the PBX, the humbug plug-in authenticates the call against the configured rules of these alerts, and if a deviation is found then it drops the call by sending a command to the Asterisk Manager Interface. In some cases the authentication is done(Continue reading)
Asterisk Project Security Advisory - AST-2012-003
Product Asterisk
Summary Stack Buffer Overflow in HTTP Manager
Nature of Advisory Exploitable Stack Buffer Overflow
Susceptibility Remote Unauthenticated Sessions
Severity Critical
Exploits Known No
Reported On 03/15/2012
Reported By Russell Bryant
Posted On 03/15/2012
Last Updated On March 15, 2012
Advisory Contact Matt Jordan < mjordan AT digium DOT com >
CVE Name
Description An attacker attempting to connect to an HTTP session of the
Asterisk Manager Interface can send an arbitrarily long
string value for HTTP Digest Authentication. This causes a
stack buffer overflow, with the possibility of remote code
injection.
Resolution Upgrade to one of the versions of Asterisk listed in the
"Corrected In" section, or apply a patch specified in the
"Patches" section.
Affected Versions
Product Release Series
Asterisk Open Source 1.8.x All versions
Asterisk Open Source 10.x All versions
(Continue reading)
Asterisk Project Security Advisory - AST-2012-002
Product Asterisk
Summary Remote Crash Vulnerability in Milliwatt Application
Nature of Advisory Exploitable Stack Buffer Overflow with locally
defined data
Susceptibility Remote Unauthenticated Sessions
Severity Minor
Exploits Known No
Reported On 03/14/2012
Reported By Russell Bryant
Posted On 03/15/2012
Last Updated On March 15, 2012
Advisory Contact Matt Jordan <mjordan AT digium DOT com>
CVE Name
Description An attacker can cause Asterisk to crash in one of two ways:
1. A dialplan uses the Milliwatt application with 'o'
option
2. The internal_timing opion in asterisk.conf is off
3. The attacker sends a large audio packet. The number of
samples in the audio packet determines the number of
internal data samples that are copied into the buffer. This
overruns the buffer, potentially causing a crash.
OR
(Continue reading)
A Metasploit module is attached that demonstrates how to enumerate
Asterisk sip peers that have a nat setting different to the global sip
nat setting as described in Asterisk Security Advisory AST-2011-013.
The example below finds all peers with nat=yes, but the metasploit module
will also work when global nat=yes and peers have nat=no.
Vulnerability discovered and exploit created by Ben Williams.
References:
http://downloads.asterisk.org/pub/security/AST-2011-013.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4597
Example sip.conf:
[general]
context=default
alwaysauthreject = yes
[1000]
nat=yes
type=peer
secret=12345cdsf0sd9r2e9
callerid=John Doe <1000>
host=dynamic
context=trusted
[1001]
nat=yes
secret=12345
type=peer
(Continue reading)
[CFP] FRHACK Africa 2012 Call For Papers
,.
. :%%%. .%%%.
__%%%(\ `%%%%% .%%%%%
/a ^ '% %%%% %: ,% %%"`
'__.. ,'% .-%: %-' %
~~""%:. ` % ' . `.
%% % ` %% .%: . \.
%%:. `-' ` .%% . %: :\
%(%,%..." `%, %%' %% ) )
%)%%)%%' )%%%.....- ' "/ (
%a:f%%\ % / \`% "%%% ` / \))
%(%' % /-. \ ' \ |-. '.
`' |% `() \| `()
|| / () /
() 0 | o
\ /\ o /
o ` /-|
,-/ ` ,-/
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ FRHACK Africa
+ Call For Papers
+ June 1-2, 2012, Casablanca, Morocco, Africa
+ http://www.frhack.org
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
"None but ourselves can free our minds", Bob Marley
(Continue reading)
RSS Feed31 | |
|---|---|
3 | |
3 | |
6 | |
1 | |
3 | |
10 | |
2 | |
13 | |
10 | |
2 | |
10 | |
16 | |
8 | |
11 | |
8 | |
7 | |
3 | |
9 | |
10 | |
3 | |
6 | |
34 | |
11 | |
28 | |
12 | |
11 | |
14 | |
17 | |
10 | |
17 | |
4 | |
3 | |
5 | |
29 | |
17 | |
31 | |
23 | |
32 | |
4 | |
25 | |
12 | |
23 | |
28 | |
17 | |
16 | |
32 | |
19 | |
16 | |
23 | |
17 | |
22 | |
16 | |
12 | |
19 | |
16 | |
27 | |
25 | |
28 | |
31 | |
9 | |
7 | |
37 | |
17 | |
66 | |
49 | |
103 | |
98 | |
206 | |
108 | |
131 | |
170 | |
100 | |
78 | |
67 | |
160 | |
80 | |
53 | |
96 | |
66 | |
45 | |
70 | |
98 | |
138 | |
189 |
