Vulnerability Note VU#521252
Integer overflow vulnerability in Asterisk driver for Cisco SCCP-enabled phones
OverviewAsterisk contains an integer overflow vulnerability. This vulnerability may allow an attacker to run arbitrary code.
I. DescriptionAsterisk is an open-source PBX software package that provides voicemail, three-way calling, and other features. Skinny Client Control Protocol (SCCP) is a proprietary Cisco protocol that is used to connect Cisco Call Managers and Cisco Voice over IP (VOIP) phones. Asterisk provides a driver for phones that use the SCCP protocol called chan_skinny.
An integer overflow vulnerability exists in the get_input(struct skinnysession *s) function which is found in the chan_skinny driver. Exploitation of this vulnerability may allow an attacker to execute arbitrary code.
Note that the chan_skinny driver only needs to be installed and loaded for a system to be vulnerable.
II. ImpactA remote, unauthenticated attacker may be able to execute arbitrary code with root privileges.
III. SolutionUpdate
The Asterisk Development Team has released an update to address this issue. See Asterisk update 1.2.13 and 1.0.12 for more details.
Restrict access
Restricting network access to port 2000/tcp on the Asterisk server may limit exposure to this vulnerability.
Do not load unnecessary drivers
Adding noload=>chan_skinny.so to the modules.conf file will prevent the vulnerable driver from loading at startup time.
Systems Affected
| Vendor | Status | Date Updated |
| Asterisk | Vulnerable | 24-Oct-2006 |
References
http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050171.html
http://secunia.com/advisories/22480/
http://www.asterisk.org/node/109
http://www.cisco.com/en/US/tech/tk652/tk701/tk589/tsd_technology_support_sub-protocol_home.html
http://www.asterisk.org/node/108
http://secunia.com/advisories/22651/
http://secunia.com/advisories/22979/
http://secunia.com/advisories/23212/
http://www.securityfocus.com/bid/20617
Credit
This vulnerability report was based on information from Adam Boileau of Security-Assessment.com.
This document was written by Ryan Giobbi.
Other Information
| Date Public | 10/18/2006 |
| Date First Published | 10/24/2006 12:58:21 PM |
| Date Last Updated | 01/19/2007 |
| CERT Advisory | |
| CVE-ID(s) | CVE-2006-5444 |
| NVD-ID(s) | CVE-2006-5444 |
| US-CERT Technical Alerts | |
| Metric | 3.82 |
| Document Revision | 40 |
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|