<div dir="ltr">PSC<br><div><br><div class="gmail_quote">---------- Forwarded message ----------<br>From: <b class="gmail_sendername">Asterisk Development Team</b> <span dir="ltr"><<a href="mailto:asteriskteam@digium.com">asteriskteam@digium.com</a>></span><br>
Date: 2013/3/27<br>Subject: [asterisk-dev] Asterisk 1.8.15-cert2, 1.8.20.2, 10.12.2, 10.12.2-digiumphones, 11.2.2 Now Available (Security Release)<br>To: <a href="mailto:asterisk-dev@lists.digium.com">asterisk-dev@lists.digium.com</a><br>
<br><br>The Asterisk Development Team has announced security releases for Certified<br>
Asterisk 1.8.15 and Asterisk 1.8, 10, and 11. The available security releases<br>
are released as versions 1.8.15-cert2, 1.8.20.2, 10.12.2, 10.12.2-digiumphones,<br>
and 11.2.2.<br>
<br>
These releases are available for immediate download at<br>
<a href="http://downloads.asterisk.org/pub/telephony/asterisk/releases" target="_blank">http://downloads.asterisk.org/pub/telephony/asterisk/releases</a><br>
<br>
The release of these versions resolve the following issues:<br>
<br>
* A possible buffer overflow during H.264 format negotiation. The format<br>
attribute resource for H.264 video performs an unsafe read against a media<br>
attribute when parsing the SDP.<br>
<br>
This vulnerability only affected Asterisk 11.<br>
<br>
* A denial of service exists in Asterisk's HTTP server. AST-2012-014, fixed<br>
in January of this year, contained a fix for Asterisk's HTTP server for a<br>
remotely-triggered crash. While the fix prevented the crash from being<br>
triggered, a denial of service vector still exists with that solution if an<br>
attacker sends one or more HTTP POST requests with very large Content-Length<br>
values.<br>
<br>
This vulnerability affects Certified Asterisk 1.8.15, Asterisk 1.8, 10, and 11<br>
<br>
* A potential username disclosure exists in the SIP channel driver. When<br>
authenticating a SIP request with alwaysauthreject enabled, allowguest<br>
disabled, and autocreatepeer disabled, Asterisk discloses whether a user<br>
exists for INVITE, SUBSCRIBE, and REGISTER transactions in multiple ways.<br>
<br>
This vulnerability affects Certified Asterisk 1.8.15, Asterisk 1.8, 10, and 11<br>
<br>
These issues and their resolutions are described in the security advisories.<br>
<br>
For more information about the details of these vulnerabilities, please read<br>
security advisories AST-2013-001, AST-2013-002, and AST-2013-003, which were<br>
released at the same time as this announcement.<br>
<br>
For a full list of changes in the current releases, please see the ChangeLogs:<br>
<br>
<a href="http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-1.8.15-cert2" target="_blank">http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-1.8.15-cert2</a><br>
<a href="http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.20.2" target="_blank">http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.20.2</a><br>
<a href="http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-10.12.2" target="_blank">http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-10.12.2</a><br>
<a href="http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-10.12.2-digiumphones" target="_blank">http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-10.12.2-digiumphones</a><br>
<a href="http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.2.2" target="_blank">http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.2.2</a><br>
<br>
The security advisories are available at:<br>
<br>
* <a href="http://downloads.asterisk.org/pub/security/AST-2013-001.pdf" target="_blank">http://downloads.asterisk.org/pub/security/AST-2013-001.pdf</a><br>
* <a href="http://downloads.asterisk.org/pub/security/AST-2013-002.pdf" target="_blank">http://downloads.asterisk.org/pub/security/AST-2013-002.pdf</a><br>
* <a href="http://downloads.asterisk.org/pub/security/AST-2013-003.pdf" target="_blank">http://downloads.asterisk.org/pub/security/AST-2013-003.pdf</a><br>
<br>
Thank you for your continued support of Asterisk!<br>
<br>
<br>
<br>
--<br>
_____________________________________________________________________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br>
<br>
asterisk-dev mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-dev" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-dev</a><br>
</div><br><br clear="all"><br>-- <br><span style="font-family:trebuchet ms,sans-serif">Sylvio Jollenbeck<br><font size="1"><a href="http://www.hosannatecnologia.com.br/" target="_blank">www.hosannatecnologia.com.br</a></font></span><br>
<img src="http://www.hosannatecnologia.com.br/pixel.fw.png"><br>
</div></div>