Home
Reading
Searching
Subscribe
Sponsors
Statistics
Posting
Contact
Spam
Lists
Links
About
Hosting
Filtering
Features Download
Marketing
Archives
FAQ
Blog
 
Gmane
From: <updates <at> fedoraproject.org>
Subject: [SECURITY] Fedora 17 Update: asterisk-10.4.2-1.fc17
Newsgroups: gmane.linux.redhat.fedora.package.announce
Date: Sunday 10th June 2012 01:36:23 UTC (over 4 years ago)
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2012-8670
2012-06-01 16:16:37
--------------------------------------------------------------------------------

Name        : asterisk
Product     : Fedora 17
Version     : 10.4.2
Release     : 1.fc17
URL         : http://www.asterisk.org/
Summary     : The Open Source PBX
Description :
Asterisk is a complete PBX in software. It runs on Linux and provides
all of the features you would expect from a PBX and more. Asterisk
does voice over IP in three protocols, and can interoperate with
almost all standards-based telephony equipment using relatively
inexpensive hardware.

--------------------------------------------------------------------------------
Update Information:

he Asterisk Development Team has announced the release of Asterisk 10.4.2.
This release is available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk

The release of Asterisk 10.4.2 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!

The following are the issues resolved in this release:

* --- Resolve crash in subscribing for MWI notifications
 (Closes issue ASTERISK-19827. Reported by B. R)

* --- Fix crash in ConfBridge when user announcement is played for
     more than 2 users
 (Closes issue ASTERISK-19899. Reported by Florian Gilcher)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.4.2

The Asterisk Development Team has announced security releases for
Certified
Asterisk 1.8.11 and Asterisk 1.8 and 10. The available security releases
are
released as versions 1.8.11-cert2, 1.8.12.1, and 10.4.1.

These releases are available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk/releases

The release of Asterisk 1.8.11-cert2, 1.8.12.1, and 10.4.1 resolve the
following
two issues:

* A remotely exploitable crash vulnerability exists in the IAX2 channel
 driver if an established call is placed on hold without a suggested music
 class. Asterisk will attempt to use an invalid pointer to the music
 on hold class name, potentially causing a crash.

* A remotely exploitable crash vulnerability was found in the Skinny
(SCCP)
 Channel driver. When an SCCP client closes its connection to the server,
 a pointer in a structure is set to NULL.  If the client was not in the
 on-hook state at the time the connection was closed, this pointer is
later
 dereferenced. This allows remote authenticated connections the ability to
 cause a crash in the server, denying services to legitimate users.

These issues and their resolution are described in the security
advisories.

For more information about the details of these vulnerabilities, please
read
security advisories AST-2012-007 and AST-2012-008, which were released at
the
same time as this announcement.

For a full list of changes in the current releases, please see the
ChangeLogs:

http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-1.8.11-cert2
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.12.1
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-10.4.1

The security advisories are available at:

 * http://downloads.asterisk.org/pub/security/AST-2012-007.pdf
 * http://downloads.asterisk.org/pub/security/AST-2012-008.pdf
--------------------------------------------------------------------------------
ChangeLog:

* Wed May 30 2012 Jeffrey Ollie <[email protected]> - 10.4.2-1
- The Asterisk Development Team has announced the release of Asterisk
10.4.2.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 10.4.2 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following are the issues resolved in this release:
-
- * --- Resolve crash in subscribing for MWI notifications
-  (Closes issue ASTERISK-19827. Reported by B. R)
-
- * --- Fix crash in ConfBridge when user announcement is played for
-      more than 2 users
-  (Closes issue ASTERISK-19899. Reported by Florian Gilcher)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.4.2
* Wed May 30 2012 Jeffrey Ollie <[email protected]> - 10.4.1-1
- The Asterisk Development Team has announced security releases for
Certified
- Asterisk 1.8.11 and Asterisk 1.8 and 10. The available security releases
are
- released as versions 1.8.11-cert2, 1.8.12.1, and 10.4.1.
-
- These releases are available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk/releases
-
- The release of Asterisk 1.8.11-cert2, 1.8.12.1, and 10.4.1 resolve the
following
- two issues:
-
- * A remotely exploitable crash vulnerability exists in the IAX2 channel
-  driver if an established call is placed on hold without a suggested
music
-  class. Asterisk will attempt to use an invalid pointer to the music
-  on hold class name, potentially causing a crash.
-
- * A remotely exploitable crash vulnerability was found in the Skinny
(SCCP)
-  Channel driver. When an SCCP client closes its connection to the server,
-  a pointer in a structure is set to NULL.  If the client was not in the
-  on-hook state at the time the connection was closed, this pointer is
later
-  dereferenced. This allows remote authenticated connections the ability
to
-  cause a crash in the server, denying services to legitimate users.
-
- These issues and their resolution are described in the security
advisories.
-
- For more information about the details of these vulnerabilities, please
read
- security advisories AST-2012-007 and AST-2012-008, which were released at
the
- same time as this announcement.
-
- For a full list of changes in the current releases, please see the
ChangeLogs:
-
- http://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-1.8.11-cert2
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.12.1
- http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-10.4.1
-
- The security advisories are available at:
-
-  * http://downloads.asterisk.org/pub/security/AST-2012-007.pdf
-  * http://downloads.asterisk.org/pub/security/AST-2012-008.pdf
* Fri May  4 2012 Jeffrey Ollie <[email protected]> - 10.4.0-1
- The Asterisk Development Team has announced the release of Asterisk
10.4.0.
- This release is available for immediate download at
- http://downloads.asterisk.org/pub/telephony/asterisk
-
- The release of Asterisk 10.4.0 resolves several issues reported by the
- community and would have not been possible without your participation.
- Thank you!
-
- The following are the issues resolved in this release:
-
- * --- Prevent chanspy from binding to zombie channels
-  (Closes issue ASTERISK-19493. Reported by lvl)
-
- * --- Fix Dial m and r options and forked calls generating warnings
-      for voice frames.
-  (Closes issue ASTERISK-16901. Reported by Chris Gentle)
-
- * --- Remove ISDN hold restriction for non-bridged calls.
-  (Closes issue ASTERISK-19388. Reported by Birger Harzenetter)
-
- * --- Fix copying of CDR(accountcode) to local channels.
-  (Closes issue ASTERISK-19384. Reported by jamicque)
-
- * --- Ensure Asterisk acknowledges ACKs to 4xx on Replaces errors
-  (Closes issue ASTERISK-19303. Reported by Jon Tsiros)
-
- * --- Eliminate double close of file descriptor in manager.c
-  (Closes issue ASTERISK-18453. Reported by Jaco Kroon)
-
- For a full list of changes in this release, please see the ChangeLog:
-
- http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.4.0
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #826474 - CVE-2012-2947 asterisk: Remote crash in IAX2 channel
driver (AST-2012-007)
        https://bugzilla.redhat.com/show_bug.cgi?id=826474
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update asterisk' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on
the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
[email protected]
https://admin.fedoraproject.org/mailman/listinfo/package-announce
 
CD: 2ms