Asterisk CVE-2009-2725 RTP Remote Crash Vulnerability Advisory

Key Information Summary Vulnerability Description: - Product: Asterisk - Summary: Remote crash vulnerability in RTP stack - Vulnerability Type: Exploitable crash - Impact: Remote unauthenticated sessions - Severity: Critical - Known Exploits: None - Report Date: July 27, 2009 - Reporter: Marcus Hunger CVE Name: CVE-2009-2725 Vulnerability Details: - Description: An attacker can remotely crash Asterisk by sending maliciously crafted RTP text frames. While the attacker can cause Asterisk to crash, they cannot execute arbitrary remote code via this vulnerability. Affected Versions: - Open Source Asterisk: - 1.2.x: Not affected - 1.4.x: Not affected - 1.6.x: All 1.6.1 versions affected - Asterisk Add-ons: - 1.2.x, 1.4.x, 1.6.x: Not affected - Asterisk Business Edition: - A.x.x, B.x.x, C.x.x: Not affected - Other Versions: - AsteriskNOW 1.5: Not affected - s800i (Asterisk device): Not affected Remediation: - Upgrade to the versions listed in the "Fixed Versions" section. Fixed Versions: - Product: Open Source Asterisk 1.6.1 - Version: 1.6.1.2 Patch Download Link: - http://downloads.digium.com/pub/security/AST-2009-004-1.6.1.diff.txt (version 1.6.1) History of Revisions: - July 27, 2009: Initial draft by Mark Michelson - July 31, 2009: Mark Michelson added a note clarifying that remote code execution is not possible - August 2, 2009: Public release by Tilghman Lesher - August 10, 2009: CVE identifier added by Tilghman Lesher

Goal Reached Thanks to every supporter — we hit 100%!

Asterisk CVE-2009-2725 RTP Remote Crash Vulnerability Advisory