Test ID:	1.3.6.1.4.1.25623.1.0.61351
Category:	Fedora Local Security Checks
Title:	Fedora Core 9 FEDORA-2008-6853 (asterisk)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to asterisk announced via advisory FEDORA-2008-6853. Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware. Update Information: Security fixes for CVE-2008-3263 / AST-2008-010 and CVE-2008-3264 / AST-2008-011: AST-2008-010: Asterisk IAX 'POKE' resource exhaustion - http://downloads.digium.com/pub/security/AST-2008-010.html AST-2008-011: Traffic amplification in IAX2 firmware provisioning system - http://downloads.digium.com/pub/security/AST-2008-011.html Bugfixes: - Add patch SVN patch for asterisk crash when used with LDAP backend (#442011) ChangeLog: * Fri Jul 25 2008 Jeffrey C. Ollie - 1.6.0-0.19.beta9 - Add patch pulled from upstream SVN that fixes AST-2008-010 and AST-2008-011. * Fri Jul 25 2008 Jeffrey C. Ollie - 1.6.0-0.18.beta9 - Add patch for LDAP extracted from upstream SVN (#442011) References: [ 1 ] Bug #442011 - Asterisk crashed when using realtime LDAP backend https://bugzilla.redhat.com/show_bug.cgi?id=442011 Solution: Apply the appropriate updates. This update can be installed with the yum update program. Use su -c 'yum update asterisk' at the command line. For more information, refer to Managing Software with yum, available at http://docs.fedoraproject.org/yum/. http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2008-6853 Risk factor : High CVSS Score: 7.8
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2008-3263 BugTraq ID: 30321 http://www.securityfocus.com/bid/30321 Bugtraq: 20080722 AST-2008-010: Asterisk IAX 'POKE' resource exhaustion (Google Search) http://www.securityfocus.com/archive/1/494675/100/0/threaded https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00839.html http://security.gentoo.org/glsa/glsa-200905-01.xml http://downloads.securityfocus.com/vulnerabilities/exploits/30321.pl http://www.securitytracker.com/id?1020535 http://secunia.com/advisories/31178 http://secunia.com/advisories/31194 http://secunia.com/advisories/34982 http://www.vupen.com/english/advisories/2008/2168/references XForce ISS Database: asterisk-poke-dos(43942) https://exchange.xforce.ibmcloud.com/vulnerabilities/43942 Common Vulnerability Exposure (CVE) ID: CVE-2008-3264 BugTraq ID: 30350 http://www.securityfocus.com/bid/30350 Bugtraq: 20080722 AST-2008-011: Traffic amplification in IAX2 firmware provisioning system (Google Search) http://www.securityfocus.com/archive/1/494676/100/0/threaded http://www.securitytracker.com/id?1020536 XForce ISS Database: asterisk-downloadprotocol-dos(43955) https://exchange.xforce.ibmcloud.com/vulnerabilities/43955
Copyright	Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.