Summary
The remote host is missing an update to asterisk
announced via advisory DSA 2225-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202225-1
Insight
Several vulnerabilities have been discovered in Asterisk, an Open Source PBX and telephony toolkit.
CVE-2011-1147
Matthew Nicholson discovered that incorrect handling of UDPTL packets may lead to denial of service of the execution of arbitrary code.
CVE-2011-1174
Blake Cornell discovered that incorrect connection handling in the manager interface may lead to denial of service.
CVE-2011-1175
Blake Cornell and Chris May discovered that incorrect TCP connection handling may lead to denial of service.
CVE-2011-1507
Tzafrir Cohen discovered that insufficient limitation of connection requests in several TCP based services may lead to denial of service.
Please see http://downloads.asterisk.org/pub/security/AST-2011-005.html for details.
CVE-2011-1599
Matthew Nicholson discovered a privilege escalation vulnerability in the manager interface.
For the oldstable distribution (lenny), this problem has been fixed in version 1:1.4.21.2~dfsg-3+lenny2.1.
For the stable distribution (squeeze), this problem has been fixed in version 1:1.6.2.9-2+squeeze2.
For the unstable distribution (sid), this problem has been fixed in version 1:1.8.3.3-1.
We recommend that you upgrade your asterisk packages.
Severity
Classification
-
CVE CVE-2011-1147, CVE-2011-1174, CVE-2011-1175, CVE-2011-1507, CVE-2011-1599 -
CVSS Base Score: 9.0
AV:N/AC:L/Au:S/C:C/I:C/A:C
Related Vulnerabilities