| Description: | Description:
The remote host is missing an update to asterisk
announced via advisory FEDORA-2010-3724.
Update Information:
Update to 1.6.1.17 * AST-2010-003: Invalid parsing of ACL rules can compromise
security * AST-2010-002: This security release is intended to raise awareness of
how it is possible to insert malicious strings into dialplans, and to advise
developers to read the best practices documents so that they may easily avoid
these dangers. * AST-2010-001: An attacker attempting to negotiate T.38 over SIP
can remotely crash Asterisk by modifying the FaxMaxDatagram field of the SDP to
contain either a negative or exceptionally large value. The same crash occurs
when the FaxMaxDatagram field is omitted from the SDP as well.
References:
[ 1 ] Bug #561332 - CVE-2010-0441 Asterisk: Remote DoS via specially-crafted FaxMaxDatagram SDP packets (AST-2010-001)
https://bugzilla.redhat.com/show_bug.cgi?id=561332
Solution: Apply the appropriate updates.
This update can be installed with the yum update program. Use
su -c 'yum update asterisk' at the command line.
For more information, refer to Managing Software with yum,
available at http://docs.fedoraproject.org/yum/.
http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2010-3724
Risk factor : High
CVSS Score:
7.5
|
