oss-security - Re: CVE Request -- Asterisk: Stack-based buffer overflow by forming an outgoing SIP request with specially-crafted caller ID information (AST-2011-001)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1295444206.15884.32.camel@solo.digium.internal>
Date: Wed, 19 Jan 2011 07:36:46 -0600
From: Matthew Nicholson <mnicholson@...ium.com>
To: "Steven M. Christey" <coley@...-smtp.mitre.org>
Cc: oss-security <oss-security@...ts.openwall.com>
Subject: Re: CVE Request -- Asterisk: Stack-based buffer
 overflow by forming an outgoing SIP request with specially-crafted caller
 ID information (AST-2011-001)

On Wed, 2011-01-19 at 07:21 -0500, Steven M. Christey wrote:
> On Wed, 19 Jan 2011, Jan Lieskovsky wrote:
> 
> >  Asterisk upstream yesterday released AST-2011-001, also with patches for 
> > supported versions.
> >  References:
> >  [1] http://downloads.asterisk.org/pub/security/AST-2011-001.html
> >  [2] http://seclists.org/fulldisclosure/2011/Jan/297
> >  [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610487
> >  [4] https://bugzilla.redhat.com/show_bug.cgi?id=670777
> 
> Use CVE-2011-0495
> 
> - Steve

Our website has been updated with this information.

-- 
Matthew Nicholson
Digium, Inc. | Software Developer

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.