—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2014:078
http://www.mandriva.com/en/support/security/
_______________________________________________________________________
Package : asterisk
Date : January 16, 2014
Affected: Business Server 1.0
_______________________________________________________________________
Problem Description:
Multiple vulnerabilities has been discovered and corrected in asterisk:
Sending a HTTP request that is handled by Asterisk with a large number
of Cookie headers could overflow the stack. You could even exhaust
memory if you sent an unlimited number of headers in the request
(CVE-2014-2286).
An attacker can use all available file descriptors using SIP INVITE
requests. Asterisk will respond with code 400, 420, or 422 for INVITEs
meeting this criteria. Each INVITE meeting these conditions will leak
a channel and several file descriptors. The file descriptors cannot
be released without restarting Asterisk which may allow intrusion
detection systems to be bypassed by sending the requests slowly
(CVE-2014-2287).
The updated packages has been upgraded to the 11.8.1 version which
is not vulnerable to these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2286
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2287
http://downloads.asterisk.org/pub/security/AST-2014-001.html
http://downloads.asterisk.org/pub/security/AST-2014-002.html
http://downloads.asterisk.org/pub/telephony/asterisk/asterisk-11.8.1-summary.html
_______________________________________________________________________
Updated Packages:
Mandriva Business Server 1/X86_64:
874dc48147428760673777cf9f0883c1 mbs1/x86_64/asterisk-11.8.1-1.1.mbs1.x86_64.rpm
754c24b57a249f5a811de9ea42491b54 mbs1/x86_64/asterisk-addons-11.8.1-1.1.mbs1.x86_64.rpm
e3f76b59108f69d490ad15b0714d0199 mbs1/x86_64/asterisk-devel-11.8.1-1.1.mbs1.x86_64.rpm
f74de033fc0f8253c1d9b8a2789fb527 mbs1/x86_64/asterisk-firmware-11.8.1-1.1.mbs1.x86_64.rpm
55129ac6c361daaef8da67ba7be0459c mbs1/x86_64/asterisk-gui-11.8.1-1.1.mbs1.x86_64.rpm
14d0511440107e30ae336ecdca0be59b mbs1/x86_64/asterisk-plugins-alsa-11.8.1-1.1.mbs1.x86_64.rpm
41e1faffe1723876b0c923e2fe6edd33 mbs1/x86_64/asterisk-plugins-calendar-11.8.1-1.1.mbs1.x86_64.rpm
bf12035dfc03a04491da69c75b60cd12 mbs1/x86_64/asterisk-plugins-cel-11.8.1-1.1.mbs1.x86_64.rpm
95d8343789fecaffbe7c0e48f7f7dd52 mbs1/x86_64/asterisk-plugins-corosync-11.8.1-1.1.mbs1.x86_64.rpm
b2abd8598301c972c87d43f231a3f38b mbs1/x86_64/asterisk-plugins-curl-11.8.1-1.1.mbs1.x86_64.rpm
283283874e245047cfdbc1942641f6d7 mbs1/x86_64/asterisk-plugins-dahdi-11.8.1-1.1.mbs1.x86_64.rpm
def694a9a67a6941eb8000309a3d8714 mbs1/x86_64/asterisk-plugins-fax-11.8.1-1.1.mbs1.x86_64.rpm
9873bafb3e6b6ac8f120681f613f3cc3 mbs1/x86_64/asterisk-plugins-festival-11.8.1-1.1.mbs1.x86_64.rpm
15179ea325b192805303066fe871036e mbs1/x86_64/asterisk-plugins-ices-11.8.1-1.1.mbs1.x86_64.rpm
ba2c090fba82b88b1ca4df296bd2481b mbs1/x86_64/asterisk-plugins-jabber-11.8.1-1.1.mbs1.x86_64.rpm
7cc400611598886a409fb8c88ef2c1a8 mbs1/x86_64/asterisk-plugins-jack-11.8.1-1.1.mbs1.x86_64.rpm
c2154c8cc9dc2e97fe72b6813db49f6f mbs1/x86_64/asterisk-plugins-ldap-11.8.1-1.1.mbs1.x86_64.rpm
9d236fe1a49ce75c2e24e45a4909fb37 mbs1/x86_64/asterisk-plugins-lua-11.8.1-1.1.mbs1.x86_64.rpm
c77efd21f409fdccdac885250401bf5b mbs1/x86_64/asterisk-plugins-minivm-11.8.1-1.1.mbs1.x86_64.rpm
854026c676dc1b1d7ef5a9a893be9577 mbs1/x86_64/asterisk-plugins-mobile-11.8.1-1.1.mbs1.x86_64.rpm
94ea8dfd0ec5c49934f9b41a05555e9e mbs1/x86_64/asterisk-plugins-mp3-11.8.1-1.1.mbs1.x86_64.rpm
c1fabd448cd867adee2ca3a76dde6bfb mbs1/x86_64/asterisk-plugins-mysql-11.8.1-1.1.mbs1.x86_64.rpm
16fdb65e155295275c8030d5a49cf405 mbs1/x86_64/asterisk-plugins-ooh323-11.8.1-1.1.mbs1.x86_64.rpm
04ceda6e0f9e2cc6667ad1da79b293c4 mbs1/x86_64/asterisk-plugins-osp-11.8.1-1.1.mbs1.x86_64.rpm
7d6cabe58838c7fc78591e4be9e56f2a mbs1/x86_64/asterisk-plugins-oss-11.8.1-1.1.mbs1.x86_64.rpm
c1e60796fb9c8f7f586a6442efd8451a mbs1/x86_64/asterisk-plugins-pgsql-11.8.1-1.1.mbs1.x86_64.rpm
c906a6deb3b0a7175170c623857400a6 mbs1/x86_64/asterisk-plugins-pktccops-11.8.1-1.1.mbs1.x86_64.rpm
9755b277eaea6189fc748f476fb3b7b7 mbs1/x86_64/asterisk-plugins-portaudio-11.8.1-1.1.mbs1.x86_64.rpm
10dc20a29f0e93c535bd6ae2f5d7bd3f mbs1/x86_64/asterisk-plugins-radius-11.8.1-1.1.mbs1.x86_64.rpm
ce94490f0722222165f39dd080983906 mbs1/x86_64/asterisk-plugins-saycountpl-11.8.1-1.1.mbs1.x86_64.rpm
aede3e915a106ed25e7a34130d8661d8 mbs1/x86_64/asterisk-plugins-skinny-11.8.1-1.1.mbs1.x86_64.rpm
a5a9bf5903f40542a71bd9ea7dde8590 mbs1/x86_64/asterisk-plugins-snmp-11.8.1-1.1.mbs1.x86_64.rpm
bfa50fb63a88f8f86d5aefdedc683c10 mbs1/x86_64/asterisk-plugins-speex-11.8.1-1.1.mbs1.x86_64.rpm
af665709f0f799289a8f4dcc3b7d2e3a mbs1/x86_64/asterisk-plugins-sqlite-11.8.1-1.1.mbs1.x86_64.rpm
62488f0a52ab46c03d6afb3028085c04 mbs1/x86_64/asterisk-plugins-tds-11.8.1-1.1.mbs1.x86_64.rpm
deb26eb56468a4a6563c6356820cd908 mbs1/x86_64/asterisk-plugins-unistim-11.8.1-1.1.mbs1.x86_64.rpm
37f8d70a41006d36e4d7b4fdf818284d mbs1/x86_64/asterisk-plugins-voicemail-11.8.1-1.1.mbs1.x86_64.rpm
279a002fa68d85b4c6dd511a613cd7ef mbs1/x86_64/asterisk-plugins-voicemail-imap-11.8.1-1.1.mbs1.x86_64.rpm
8a60a940674e0d44812e68957ed28e24 mbs1/x86_64/asterisk-plugins-voicemail-plain-11.8.1-1.1.mbs1.x86_64.rpm
f276cf7f4755f67438e42b1990eb9ad1 mbs1/x86_64/lib64asteriskssl1-11.8.1-1.1.mbs1.x86_64.rpm
bff672404f7226e39771ea197ae43111 mbs1/SRPMS/asterisk-11.8.1-1.1.mbs1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)
iD4DBQFTTmmZmqjQ0CJFipgRAgZhAJiZvnPkmS1CodQe2SU6N9KH7gqrAKDexk/g
PoAfzdBLpkgcjjZNAgjVGA==
=81VZ
—–END PGP SIGNATURE—–
To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________
7e
