-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Product: Asterisk Open Source PBX
Impact: Multiple Local and Remote Denials of Service
MITRE CVE-2006-5445
FRSIRT ADV-2006-4098
Version(s): All versions PRIOR TO 1.2.13
Author: Jesus Oquendo
echo @infiltrated|sed 's/^/sil/g;s/$/.net/g'


I. BACKGROUND
Asterisk is an Open Source PBX which runs on Linux, BSD, Solaris and MacOSX that provides all of
the features in a standard PBX. Asterisk does voice over IP and can interoperate with almost all
telephony equipment.

II. DESCRIPTION
A vulnerability in the SIP channel driver (channels/chan_sip.c) in all versions of Asterisk prior
to 1.2.13. Local and remote attackers are able to cause a denial of service (resource consumption)
via unspecified vectors that result in the creation of "a real pvt structure" that uses more
resources than necessary.

III SOLUTION
Versions 1.2.13 and greater are no longer vulnerable to the attack and users are urged to update
to 1.2.13 or better.

IV. SOURCE
http://www.infiltrated.net/asteroid/asteroidv1.tar.gz

V. POSSIBILITIES
While the initial packet creation tool was tested on Asterisk, it was not targeted towards Asterisk
but at the SIP protocol. Asterisk was used merely for Wireshark packet captures in order to re-create
newer packets. The Asteroid SIP denial of service tool could also affect other products that run the
SIP protocol including soft phones, other PBX's, etc.

VI. MENTIONS
Thanks to Kevin P. Flemming and the guys at Asterisk fixing this promptly. Dan York for getting people
to pay attention. Tim Donahue for his Perl pointers, vgersh99 (aka vlad) for nawk pointers, PHV,
Annihilannic, p5wizard, Anthony LaMantia, Tzafir Cohen, and the others on the Asterisk-Dev list.

VII. TESTBED
Tested on Solaris, FreeBSD, Linux (SuSE, CentOS, Gentoo, Debian) distributions running various versions
Asterisk.

VIII. CHECKSUMS

$ md5 asteroidv1.tar.gz 
MD5 (asteroidv1.tar.gz) = b32c56ab4004d2a75eeee109d9e8d824

$ sha1 asteroidv1.tar.gz 
SHA1 (asteroidv1.tar.gz) = 0345fc7e423bddb8d9aa5fae431c0715db70a879


=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
echo @infiltrated|sed 's/^/sil/g;s/$/.net/g'
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743

"How a man plays the game shows something of his
character - how he loses shows all" - Mr. Luckey

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (FreeBSD)

iD8DBQFFSjjZh3J3NhODp0MRAjheAKDvN9nCk8RYXiL0LlwCqvTx1MBxiwCg8Pcl
D+fR6dikWMyCzW+UZTCat48=
=2ekf
-----END PGP SIGNATURE-----