API tools faq
paste
Advertisement
Guest User

Untitled

a guest
May 7th, 2017
531
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 7.69 KB | None | 0 0
raw download clone embed print report
  1. diff -u asterisk-1.4.17~dfsg/debian/patches/series asterisk-1.4.17~dfsg/debian/patches/series
  2. --- asterisk-1.4.17~dfsg/debian/patches/series
  3. +++ asterisk-1.4.17~dfsg/debian/patches/series
  4. @@ -83,0 +84,5 @@
  5. +
  6. +# Ubuntu CVE fixes
  7. +CVE-2008-1289
  8. +CVE-2008-1332
  9. +CVE-2008-1333
  10. diff -u asterisk-1.4.17~dfsg/debian/control asterisk-1.4.17~dfsg/debian/control
  11. --- asterisk-1.4.17~dfsg/debian/control
  12. +++ asterisk-1.4.17~dfsg/debian/control
  13. @@ -1,7 +1,8 @@
  14. Source: asterisk
  15. Priority: optional
  16. Section: comm
  17. -Maintainer: Debian VoIP Team <pkg-voip-maintainers@lists.alioth.debian.org>
  18. +Maintainer: Ubuntu MOTU Developers <ubuntu-motu@lists.ubuntu.com>
  19. +XSBC-Original-Maintainer: Debian VoIP Team <pkg-voip-maintainers@lists.alioth.debian.org>
  20. Uploaders: Mark Purcell <msp@debian.org>, Kilian Krause <kilian@debian.org>, Tzafrir Cohen <tzafrir.cohen@xorcom.com>, Faidon Liambotis <paravoid@debian.org>
  21. Build-Depends: debhelper (>= 5), quilt, zlib1g-dev, libreadline5-dev, libgsm1-dev, libssl-dev, libtonezone-dev (>= 1:1.4.1~0), bison, libasound2-dev, libpq-dev, unixodbc-dev, libpri-dev (>= 1.4.1-1), libvpb-dev, zaptel-source (>= 1:1.4.1~0), autotools-dev, libnewt-dev, libsqlite-dev, libspeex-dev, graphviz, libcurl4-openssl-dev | libcurl-dev, doxygen, gsfonts, libpopt-dev, libopenh323-dev (>= 1.17.4-1), libiksemel-dev, libradiusclient-ng-dev, freetds-dev, libvorbis-dev, libsnmp-dev, libc-client2007-dev | libc-client-dev, libcap-dev
  22. Standards-Version: 3.7.3
  23. diff -u asterisk-1.4.17~dfsg/debian/changelog asterisk-1.4.17~dfsg/debian/changelog
  24. --- asterisk-1.4.17~dfsg/debian/changelog
  25. +++ asterisk-1.4.17~dfsg/debian/changelog
  26. @@ -1,3 +1,25 @@
  27. +asterisk (1:1.4.17~dfsg-2ubuntu1) hardy; urgency=low
  28. +
  29. + * SECURITY UPDATE: arbitrary code execution and authentication bypass.
  30. + (LP: #210124)
  31. + - debian/patches/CVE-2008-1289: Check that incoming RTP payloads are
  32. + within buffer limits. Patch from Debian.
  33. + - debian/patches/CVE-2008-1332: Ensure that allowguest has been enabled
  34. + before deciding that authentication isn't required. Patch from Debian.
  35. + - debian/patches/CVE-2008-1333: Interpret logging output as a character
  36. + string, not a format string. Patch from Debian.
  37. + - References:
  38. + + CVE-2008-1289
  39. + + CVE-2008-1332
  40. + + CVE-2008-1333
  41. + + AST-2008-002
  42. + + AST-2008-003
  43. + + AST-2008-004
  44. + * Modify Maintainer value to match the DebianMaintainerField
  45. + specification.
  46. +
  47. + -- William Grant <william@qeuni.net> Sat, 05 Apr 2008 11:32:12 +1100
  48. +
  49. asterisk (1:1.4.17~dfsg-2build1) hardy; urgency=low
  50.  
  51. * Rebuild for libc-client2006j2 -> libc-client2007 transition (LP: #192415).
  52. only in patch2:
  53. unchanged:
  54. --- asterisk-1.4.17~dfsg.orig/debian/patches/CVE-2008-1333
  55. +++ asterisk-1.4.17~dfsg/debian/patches/CVE-2008-1333
  56. @@ -0,0 +1,12 @@
  57. +diff -urNad asterisk-1.4.17~dfsg~/include/asterisk/astobj.h asterisk-1.4.17~dfsg/include/asterisk/astobj.h
  58. +--- asterisk-1.4.17~dfsg~/include/asterisk/astobj.h 2006-02-15 06:14:15.000000000 +1100
  59. ++++ asterisk-1.4.17~dfsg/include/asterisk/astobj.h 2008-04-05 11:12:28.000000000 +1100
  60. +@@ -813,7 +813,7 @@
  61. + * descriptor.
  62. + */
  63. + #define ASTOBJ_CONTAINER_DUMP(fd,s,slen,container) \
  64. +- ASTOBJ_CONTAINER_TRAVERSE(container, 1, do { ASTOBJ_DUMP(s,slen,iterator); ast_cli(fd, s); } while(0))
  65. ++ ASTOBJ_CONTAINER_TRAVERSE(container, 1, do { ASTOBJ_DUMP(s,slen,iterator); ast_cli(fd, "%s", s); } while(0))
  66. +
  67. + #if defined(__cplusplus) || defined(c_plusplus)
  68. + }
  69. only in patch2:
  70. unchanged:
  71. --- asterisk-1.4.17~dfsg.orig/debian/patches/CVE-2008-1332
  72. +++ asterisk-1.4.17~dfsg/debian/patches/CVE-2008-1332
  73. @@ -0,0 +1,12 @@
  74. +diff -urNad asterisk-1.4.17~dfsg~/channels/chan_sip.c asterisk-1.4.17~dfsg/channels/chan_sip.c
  75. +--- asterisk-1.4.17~dfsg~/channels/chan_sip.c 2008-04-05 11:08:51.000000000 +1100
  76. ++++ asterisk-1.4.17~dfsg/channels/chan_sip.c 2008-04-05 11:11:37.000000000 +1100
  77. +@@ -9305,8 +9305,6 @@
  78. + ast_shrink_phone_number(tmp);
  79. + ast_string_field_set(p, cid_num, tmp);
  80. + }
  81. +- if (ast_strlen_zero(of))
  82. +- return AUTH_SUCCESSFUL;
  83. +
  84. + if (!authpeer) /* If we are looking for a peer, don't check the user objects (or realtime) */
  85. + user = find_user(of, 1);
  86. only in patch2:
  87. unchanged:
  88. --- asterisk-1.4.17~dfsg.orig/debian/patches/CVE-2008-1289
  89. +++ asterisk-1.4.17~dfsg/debian/patches/CVE-2008-1289
  90. @@ -0,0 +1,77 @@
  91. +diff -urNad asterisk-1.4.17~dfsg~/channels/chan_sip.c asterisk-1.4.17~dfsg/channels/chan_sip.c
  92. +--- asterisk-1.4.17~dfsg~/channels/chan_sip.c 2008-04-05 11:05:32.000000000 +1100
  93. ++++ asterisk-1.4.17~dfsg/channels/chan_sip.c 2008-04-05 11:05:37.000000000 +1100
  94. +@@ -214,6 +214,8 @@
  95. + #define SIP_MAX_LINES 64 /*!< Max amount of lines in SIP attachment (like SDP) */
  96. + #define SIP_MAX_PACKET 4096 /*!< Also from RFC 3261 (2543), should sub headers tho */
  97. +
  98. ++#define SDP_MAX_RTPMAP_CODECS 32 /*!< Maximum number of codecs allowed in received SDP */
  99. ++
  100. + #define INITIAL_CSEQ 101 /*!< our initial sip sequence number */
  101. +
  102. + /*! \brief Global jitterbuffer configuration - by default, jb is disabled */
  103. +@@ -4975,7 +4977,7 @@
  104. + int numberofmediastreams = 0;
  105. + int debug = sip_debug_test_pvt(p);
  106. +
  107. +- int found_rtpmap_codecs[32];
  108. ++ int found_rtpmap_codecs[SDP_MAX_RTPMAP_CODECS];
  109. + int last_rtpmap_codec=0;
  110. +
  111. + if (!p->rtp) {
  112. +@@ -5248,24 +5250,30 @@
  113. + /* We should propably check if this is an audio or video codec
  114. + so we know where to look */
  115. +
  116. +- /* Note: should really look at the 'freq' and '#chans' params too */
  117. +- if(ast_rtp_set_rtpmap_type(newaudiortp, codec, "audio", mimeSubtype,
  118. +- ast_test_flag(&p->flags[0], SIP_G726_NONSTANDARD) ? AST_RTP_OPT_G726_NONSTANDARD : 0) != -1) {
  119. +- if (debug)
  120. +- ast_verbose("Found audio description format %s for ID %d\n", mimeSubtype, codec);
  121. +- found_rtpmap_codecs[last_rtpmap_codec] = codec;
  122. +- last_rtpmap_codec++;
  123. +- found = TRUE;
  124. +-
  125. +- } else if (p->vrtp) {
  126. +- if(ast_rtp_set_rtpmap_type(newvideortp, codec, "video", mimeSubtype, 0) != -1) {
  127. ++ if (last_rtpmap_codec < SDP_MAX_RTPMAP_CODECS) {
  128. ++ /* Note: should really look at the 'freq' and '#chans' params too */
  129. ++ if(ast_rtp_set_rtpmap_type(newaudiortp, codec, "audio", mimeSubtype,
  130. ++ ast_test_flag(&p->flags[0], SIP_G726_NONSTANDARD) ? AST_RTP_OPT_G726_NONSTANDARD : 0) != -1) {
  131. + if (debug)
  132. +- ast_verbose("Found video description format %s for ID %d\n", mimeSubtype, codec);
  133. ++ ast_verbose("Found audio description format %s for ID %d\n", mimeSubtype, codec);
  134. + found_rtpmap_codecs[last_rtpmap_codec] = codec;
  135. + last_rtpmap_codec++;
  136. + found = TRUE;
  137. ++
  138. ++ } else if (p->vrtp) {
  139. ++ if(ast_rtp_set_rtpmap_type(newvideortp, codec, "video", mimeSubtype, 0) != -1) {
  140. ++ if (debug)
  141. ++ ast_verbose("Found video description format %s for ID %d\n", mimeSubtype, codec);
  142. ++ found_rtpmap_codecs[last_rtpmap_codec] = codec;
  143. ++ last_rtpmap_codec++;
  144. ++ found = TRUE;
  145. ++ }
  146. + }
  147. ++ } else {
  148. ++ if (debug)
  149. ++ ast_verbose("Discarded description format %s for ID %d\n", mimeSubtype, codec);
  150. + }
  151. ++
  152. + if (!found) {
  153. + /* Remove this codec since it's an unknown media type for us */
  154. + /* XXX This is buggy since the media line for audio and video can have the
  155. +diff -urNad asterisk-1.4.17~dfsg~/main/rtp.c asterisk-1.4.17~dfsg/main/rtp.c
  156. +--- asterisk-1.4.17~dfsg~/main/rtp.c 2007-12-11 03:36:15.000000000 +1100
  157. ++++ asterisk-1.4.17~dfsg/main/rtp.c 2008-04-05 11:05:37.000000000 +1100
  158. +@@ -1645,6 +1645,9 @@
  159. + an unknown media type */
  160. + void ast_rtp_unset_m_type(struct ast_rtp* rtp, int pt)
  161. + {
  162. ++ if (pt < 0 || pt > MAX_RTP_PT)
  163. ++ return; /* bogus payload type */
  164. ++
  165. + ast_mutex_lock(&rtp->bridge_lock);
  166. + rtp->current_RTP_PT[pt].isAstFormat = 0;
  167. + rtp->current_RTP_PT[pt].code = 0;
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!