PT-2015-6051 · Digium · Asterisk

Maciej Szmigiero · Publicado 2015-04-10 · Atualizado 2018-10-09 · CVE-2015-3008

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.8 before 1.8.32.3 Asterisk Open Source versions 11.x before 11.17.1 Asterisk Open Source versions 12.x before 12.8.2 Asterisk Open Source versions 13.x before 13.3.2 Certified Asterisk versions 1.8.28 before 1.8.28-cert5 Certified Asterisk versions 11.6 before 11.6-cert11 Certified Asterisk versions 13.1 before 13.1-cert2

Description The issue arises when registering a SIP TLS device and does not properly handle a null byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate. This allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

Recommendations For Asterisk Open Source version 1.8, update to version 1.8.32.3 or later. For Asterisk Open Source version 11.x, update to version 11.17.1 or later. For Asterisk Open Source version 12.x, update to version 12.8.2 or later. For Asterisk Open Source version 13.x, update to version 13.3.2 or later. For Certified Asterisk version 1.8.28, update to version 1.8.28-cert5 or later. For Certified Asterisk version 11.6, update to version 11.6-cert11 or later. For Certified Asterisk version 13.1, update to version 13.1-cert2 or later.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2015-3008

DLA-455-1

DSA-3700-1

MGASA-2015-0153

Produtos afetados

Asterisk

Referências · 24

• https://ubuntu.com/security/CVE-2015-3008 · Aviso do Fabricante
• http://securityfocus.com/archive/1/535222/100/0/threaded · Nota
• http://seclists.org/fulldisclosure/2015/Apr/22 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162260.html · Aviso do Fabricante
• http://debian.org/security/2016/dsa-3700 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-3008 · Nota de Segurança
• http://advisories.mageia.org/MGASA-2015-0153.html · Nota
• https://advisories.mageia.org/MGASA-2015-0153.html · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-3008 · Nota de Segurança
• http://mandriva.com/security/advisories?name=MDVSA-2015:206 · Aviso do Fabricante
• http://packetstormsecurity.com/files/131364/Asterisk-Project-Security-Advisory-AST-2015-003.html · Nota
• https://osv.dev/vulnerability/CVE-2015-3008 · Aviso do Fabricante
• http://securityfocus.com/bid/74022 · Nota
• https://osv.dev/vulnerability/DSA-3700-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2015-0153 · Aviso do Fabricante