[Bug 956581] Re: Stack Buffer Overflow in HTTP Manager

[Paul Belanger]

Odd, I don't remember seeing that when I compiled.  Let me try test the
patch and make any changes.

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/956581

Title:
  Stack Buffer Overflow in HTTP Manager

Status in “asterisk” package in Ubuntu:
  Incomplete

Bug description:
  An attacker attempting to connect to an HTTP session of the Asterisk
  Manager Interface can send an arbitrarily long string value for HTTP
  Digest Authentication. This causes a stack buffer overflow, with the
  possibility of remote code injection.

  http://downloads.asterisk.org/pub/security/AST-2012-003.html

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/asterisk/+bug/956581/+subscriptions