Vulnerability Note VU#521252

Integer overflow vulnerability in Asterisk driver for Cisco SCCP-enabled phones

An integer overflow vulnerability exists in the get_input(struct skinnysession *s) function which is found in the chan_skinny driver. Exploitation of this vulnerability may allow an attacker to execute arbitrary code.

Note that the chan_skinny driver only needs to be installed and loaded for a system to be vulnerable.

II. Impact

The Asterisk Development Team has released an update to address this issue. See Asterisk update 1.2.13 and 1.0.12 for more details.

Restrict access
Restricting network access to port 2000/tcp on the Asterisk server may limit exposure to this vulnerability.

Do not load unnecessary drivers
Adding noload=>chan_skinny.so to the modules.conf file will prevent the vulnerable driver from loading at startup time.

Systems Affected

http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050171.html
http://secunia.com/advisories/22480/
http://www.asterisk.org/node/109
http://www.cisco.com/en/US/tech/tk652/tk701/tk589/tsd_technology_support_sub-protocol_home.html
http://www.asterisk.org/node/108
http://secunia.com/advisories/22651/
http://secunia.com/advisories/22979/
http://secunia.com/advisories/23212/
http://www.securityfocus.com/bid/20617

Credit

This vulnerability report was based on information from Adam Boileau of Security-Assessment.com.

This document was written by Ryan Giobbi.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.