Actu
Vigil@nce - Asterisk Open Source: denial of service via UDPTL
April 2016 by Vigil@nce
This bulletin was written by Vigil@nce : https://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can send a malicious UDPTL packet to Asterisk Open
Source, in order to trigger a denial of service.
Impacted products: Asterisk Open Source.
Severity: 2/4.
Creation date: 04/02/2016.
DESCRIPTION OF THE VULNERABILITY
The Asterisk Open Source product can receive faxes over UDPTL.
These UDPTL packets are logically redundant, in order to help for
packet loss recovery. However, when such an empty packet is
received before a loss is detected, Astersk looks for recovery
data in an invalid memory area, which trigger a fatal exception.
An attacker can therefore send a malicious UDPTL packet to
Asterisk Open Source, in order to trigger a denial of service.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
https://vigilance.fr/vulnerability/Asterisk-Open-Source-denial-of-service-via-UDPTL-18871
