Tags › Security Advisory
Asterisk PJSIP: stack corruption via large Accept header in SUBSCRIBE
Published on Feb 22, 2018 in CVE-2018-7284, asterisk, pjsip, stack corruption, denial of service, security advisory
- Authors:
- Alfred Farrugia alfred@enablesecurity.com
- Sandro Gauci sandro@enablesecurity.com
- Latest vulnerable version: Asterisk 15.2.0 running
chan_pjsip - Tested vulnerable versions: 15.2.0, 13.19.0, 14.7.5, 13.11.2
- References: AST-2018-004, CVE-2018-7284
- Advisory URL: https://www.enablesecurity.com/advisories/ES2018-01-asterisk-pjsip-subscribe-stack-corruption/
- Vendor Advisory: http://downloads.asterisk.org/pub/security/AST-2018-004.html
- Timeline:
- Issue reported to vendor: 2018-01-30
- Vendor patch made available to us: 2018-02-06
- Vendor advisory published: 2018-02-21
- Enable Security advisory: 2018-02-22
Description
A large SUBSCRIBE message with multiple malformed Accept headers will crash Asterisk due to stack corruption.
Impact
Abuse of this vulnerability leads to denial of service in Asterisk when chan_pjsip is in use. Brief analysis indicates that this is an exploitable vulnerability that may lead to remote code execution.
Asterisk PJSIP: crash via repeated INVITE messages over TCP/TLS
Published on Feb 22, 2018 in CVE-2018-7286, asterisk, pjsip, denial of service, security advisory
- Authors:
- Alfred Farrugia alfred@enablesecurity.com
- Sandro Gauci sandro@enablesecurity.com
- Latest vulnerable version: Asterisk 15.2.0 running
chan_pjsipinstalled with--with-pjproject-bundled - References: AST-2018-005, CVE-2018-7286
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2018-04-asterisk-pjsip-tcp-segfault/
- Vendor Advisory: http://downloads.asterisk.org/pub/security/AST-2018-005.html
- Tested vulnerable versions: 15.2.0, 15.1.0, 15.0.0, 13.19.0, 13.11.2, 14.7.5
- Timeline:
- Issue reported to vendor: 2018-01-24
- Vendor patch made available to us: 2018-02-05
- Vendor advisory published: 2018-02-21
- Enable Security advisory: 2018-02-22
Description
A crash occurs when a number of INVITE messages are sent over TCP or TLS and then the connection is suddenly closed. This issue leads to a segmentation fault.
…Asterisk: RTP Bleed vulnerability
Published on Sep 1, 2017 in CVE-2017-14099, asterisk, owasp, security advisory
- Authors:
- Klaus-Peter Junghanns kapejod@gmail.com
- Sandro Gauci sandro@enablesecurity.com
- Vulnerable version: Asterisk 11.4.0 to 14.6.1 (fix incomplete)
- References: AST-2017-005, AST-2017-008, CVE-2017-14099
- Advisory URL: https://www.enablesecurity.com/advisories/ES2017-04-asterisk-rtp-bleed/
- Timeline:
- First report date: 2011-09-11
- Fix applied: 2011-09-21
- Issue apparently reintroduced: 2013-03-07
- New report date: 2017-05-17
- Vendor patch provided for testing: 2017-05-23
- Vendor advisory: 2017-08-31
- Enable Security advisory: 2017-09-01
- Vendor updated advisory: 2017-09-19
Description
When Asterisk is configured with the nat=yes and strictrtp=yes (on by default) options, it is vulnerable to an attack which we call RTP Bleed. Further information about the attack can be found at https://rtpbleed.com.
Asterisk Skinny: memory exhaustion denial of service
Published on May 23, 2017 in asterisk, denial of service, security advisory
- Authors:
- Alfred Farrugia alfred@enablesecurity.com
- Sandro Gauci sandro@enablesecurity.com
- Vulnerable version: Asterisk 14.4.0 with
chan_skinnyenabled - References: AST-2017-004
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2017-03-asterisk-chan-skinny-crash/
- Vendor Advisory: http://downloads.asterisk.org/pub/security/AST-2017-004.html
- Timeline:
- Report date: 2017-04-13
- Digium confirmed issue: 2017-04-13
- Digium patch and advisory: 2017-05-19
- Enable Security advisory: 2017-05-23
Description
Sending one malformed Skinny message to port 2000 will exhaust Asterisk’s memory resulting in a crash.
Impact
Abuse of this issue allows attackers to crash Asterisk when Skinny is exposed to attackers.
How to reproduce the issue
Start Asterisk and make sure the chan_skinny module is loaded. Then execute:
Asterisk PJSIP: out-of-bound memory access in multipart parser
Published on May 23, 2017 in asterisk, pjsip, denial of service, security advisory
- Authors:
- Alfred Farrugia alfred@enablesecurity.com
- Sandro Gauci sandro@enablesecurity.com
- Vulnerable version: Asterisk 14.4.0 running
chan_pjsip, PJSIP 2.6 - References: AST-2017-003
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2017-02-asterisk-pjsip-multi-part-crash/
- Vendor Advisory: http://downloads.asterisk.org/pub/security/AST-2017-003.html
- Timeline:
- Report date: 2017-04-13
- Digium confirmed issue: 2017-04-13
- Digium patch and advisory: 2017-05-19
- PJSIP added patch by Digium: 2017-05-21
- Enable Security advisory: 2017-05-23
Description
A specially crafted SIP message with a malformed multipart body was found to cause a segmentation fault.
Impact
Abuse of this vulnerability leads to denial of service (DoS), and potentially remote code execution (RCE), in Asterisk when chan_pjsip is in use. This vulnerability is likely to affect other code that makes use of PJSIP.
Asterisk PJSIP: heap overflow in CSeq header parsing
Published on May 23, 2017 in CVE-2017-9372, asterisk, pjsip, heap overflow, security advisory
- Authors:
- Alfred Farrugia alfred@enablesecurity.com
- Sandro Gauci sandro@enablesecurity.com
- Vulnerable version: Asterisk 14.4.0 running
chan_pjsip, PJSIP 2.6 - References: AST-2017-002, CVE-2017-9372
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2017-01-asterisk-pjsip-cseq-overflow/
- Vendor Advisory: http://downloads.asterisk.org/pub/security/AST-2017-002.html
- Timeline:
- Report date: 2017-04-12
- Digium confirmed issue: 2017-04-12
- Digium patch and advisory: 2017-05-19
- PJSIP added patch by Digium: 2017-05-21
- Enable Security advisory: 2017-05-23
Description
A specially crafted SIP message with a long CSEQ value will cause a heap overflow in PJSIP.
Impact
Abuse of this vulnerability leads to denial of service in Asterisk when chan_pjsip is in use. This vulnerability is likely to be abused for remote code execution and may affect other code that makes use of PJSIP.
Liferay: XML External Entity vulnerability in OpenID component
Published on Jan 1, 2016 in liferay, xxe, security advisory
- Vulnerable version: Liferay 6.2.3 CE GA4 and earlier
- Liferay reference: LPS-58014
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2016-01-liferay-xxe/
- Timeline:
- Report date: March 16 2015
- Liferay patch: August 26 2015
- Liferay advisory: January 18 2016
- Enable Security advisory: June 1 2016
Description
Liferay supports OpenID login which was found to make use of a version of openid4java that is vulnerable to XML External Entity (XXE) attacks.
Impact
Abuse of the XXE vulnerability can (at least) lead to local file disclosure, server-side request forgery (SSRF) and denial of service. This vulnerability was abused to read local files on the web server that the web application had access to.
…Juniper VPN SSL: client-side cross-site scripting
Published on Sep 12, 2013 in CVE-2013-5649, juniper, cross-site scripting, security advisory
- Vendor advisory: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10589
- Vulnerable product that was tested: MAG-2600, Version 7.2R3 (build 21397)
- CVE: CVE-2013-5649
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2013-01-juniper-junos-dom-xss/
Description
The Juniper VPN SSL system was found to be vulnerable to a client-side cross site scripting vulnerability.
Impact
Exploitation of this vulnerability may allow hijack of VPN SSL sessions. This usually involves a social engineering attack in order to convince a logged in victim to click on an attacker-supplied URL. Therefore such an attack would typically be the result of a targeted attack rather than an opportunistic one.
…Applicure dotDefender: stored cross-site scripting in admin interface
Published on Jun 1, 2010 in dotdefender, cross-site scripting, security advisory
An advisory by EnableSecurity.
- ID: ES-20100601
- Affected Versions: version 4.0
- Fixed versions: 4.01-3 and later
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2010-01-applicure-dotDefender-stored-xss/
Description
Applicure dotDefender is a Web Application Firewall that can be installed on Windows and Linux servers.
From their website (applicure.com):
“dotDefender is the market-leading software Web Application Firewall (WAF). dotDefender boasts enterprise-class security, advanced integration capabilities, easy maintenance and low total cost of ownership (TCO). dotDefender is the perfect choice for protecting your website and web applications today.”
…
Armorlogic Profense WAF: multiple vulnerabilities
Published on May 13, 2009 in CVE-2009-1594, CVE-2009-1593, profense, cross-site scripting, security advisory
An advisory by EnableSecurity. Trustwave published a joint advisory named TWSL2009-001.
- ID: ES-20090500
- Affected Versions: versions prior to 2.4.4 and 2.2.22
- Fixed versions: 2.4.4, 2.2.22 and later
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2009-02-armorlogic-profense-multiple-vulnerabilities/
Description
Armorlogic Profense is a Web Application Firewall and load balancing solution.
From their website (armorlogic.com):
“Protecting and securing websites and web applications can be a complicated business. Profense web application firewall simplifies protection with an affordable and easy to use, feature rich, solution that gives you full PCI DSS 1.1 and 1.2 section 6.6 compliance.”
…