Integer overflow vulnerability in Asterisk driver for Cisco SCCP-enabled phones

Overview

Asterisk contains an integer overflow vulnerability. This vulnerability may allow an attacker to run arbitrary code.

Description

Asterisk is an open-source PBX software package that provides voicemail, three-way calling, and other features. Skinny Client Control Protocol (SCCP) is a proprietary Cisco protocol that is used to connect Cisco Call Managers and Cisco Voice over IP (VOIP) phones. Asterisk provides a driver for phones that use the SCCP protocol called chan_skinny.

An integer overflow vulnerability exists in the get_input(struct skinnysession *s) function which is found in the chan_skinny driver. Exploitation of this vulnerability may allow an attacker to execute arbitrary code.

Note that the chan_skinny driver only needs to be installed and loaded for a system to be vulnerable.

---

Impact

A remote, unauthenticated attacker may be able to execute arbitrary code with root privileges.

---

Solution

Update
The Asterisk Development Team has released an update to address this issue. See Asterisk update 1.2.13 and 1.0.12 for more details.

---

Restrict access
Restricting network access to port 2000/tcp on the Asterisk server may limit exposure to this vulnerability.

Do not load unnecessary drivers
Adding noload=>chan_skinny.so to the modules.conf file will prevent the vulnerable driver from loading at startup time.

---

Vendor Information

521252

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Asterisk __ Affected

Updated: October 24, 2006

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

See <http://www.asterisk.org/node/109&gt; for more details.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23521252 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050171.html&gt;
• <http://secunia.com/advisories/22480/&gt;
• <http://www.asterisk.org/node/109&gt;
• <http://www.cisco.com/en/US/tech/tk652/tk701/tk589/tsd_technology_support_sub-protocol_home.html&gt;
• <http://www.asterisk.org/node/108&gt;
• <http://secunia.com/advisories/22651/&gt;
• <http://secunia.com/advisories/22979/&gt;
• <http://secunia.com/advisories/23212/&gt;
• <http://www.securityfocus.com/bid/20617&gt;

Acknowledgements

This vulnerability report was based on information from Adam Boileau of Security-Assessment.com.

This document was written by Ryan Giobbi.

Other Information

CVE IDs:	CVE-2006-5444
Severity Metric:	3.82 Date Public: