[Bug 956581] Re: Stack Buffer Overflow in HTTP Manager
Steve Beattie
sbeattie at ubuntu.com
Thu Mar 22 20:33:23 UTC 2012
Hi Paul,
When compiling with your added patches, a new compiler warning pops up:
+chan_sip.c: In function 'parse_register_contact':
+chan_sip.c:13312:2: warning: implicit declaration of function 'parse_uri_legacy_check' [-Wimplicit-function-declaration]
greping through the source, I don't see parse_uri_legacy_check() referenced anywhere except in debian/patches/AST-2011-012.diff ; is this actually correct? Was this function added after 1.8.4.4?
I've updated your debdiff to include DEP-3 references and CVE references in the changelog, it's attached. If you end up re-submitting, can you please base off it?
Thanks.
** Patch added: "Updated asterisk debdiff"
https://bugs.launchpad.net/ubuntu/+source/asterisk/+bug/956581/+attachment/2918077/+files/asterisk_1.8.4.4%7Edfsg-2ubuntu5.debdiff
** Changed in: asterisk (Ubuntu)
Status: Confirmed => Incomplete
--
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/956581
Title:
Stack Buffer Overflow in HTTP Manager
Status in “asterisk” package in Ubuntu:
Incomplete
Bug description:
An attacker attempting to connect to an HTTP session of the Asterisk
Manager Interface can send an arbitrarily long string value for HTTP
Digest Authentication. This causes a stack buffer overflow, with the
possibility of remote code injection.
http://downloads.asterisk.org/pub/security/AST-2012-003.html
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/asterisk/+bug/956581/+subscriptions
More information about the Ubuntu-sponsors
mailing list