Asterisk Project Security Advisory – AST-2014-012

Product Asterisk
Summary Mixed IP address families in access control lists
may permit unwanted traffic.
Nature of Advisory Unauthorized Access
Susceptibility Remote unauthenticated sessions
Severity Moderate
Exploits Known No
Reported On 25 October, 2014
Reported By Andreas Steinmetz
Posted On 20 November, 2014
Last Updated On November 20, 2014
Advisory Contact Mark Michelson
CVE Name Pending

Description Many modules in Asterisk that service incoming IP traffic
have ACL options (“permit” and “deny”) that can be used to
whitelist or blacklist address ranges. A bug has been
discovered where the address family of incoming packets is
only compared to the IP address family of the first entry
in the list of access control rules. If the source IP
address for an incoming packet is not of the same address
family as the first ACL entry, that packet bypasses all ACL
rules. For ACLs whose rules are all of the same address
family, there is no issue.

Note that while the incoming packet may bypass ACL rules,
the packet is still subject to any authentication
requirements that the specific protocol employs.

This issue affects the following parts of Asterisk

* All VoIP channel drivers

* DUNDi

* Asterisk Manager Interface (AMI)

Resolution The ACL code has been amended to compare the incoming
packet’s source address family against the address families
for all rules.

Affected Versions
Product Release
Series
Asterisk Open Source 1.8.x All versions
Asterisk Open Source 11.x All versions
Asterisk Open Source 12.x All versions
Asterisk Open Source 13.x All versions
Certified Asterisk 1.8.28 All versions
Certified Asterisk 11.6 All versions

Corrected In
Product Release
Asterisk Open Source 1.8.32.1, 11.14.1, 12.7.1, 13.0.1
Certified Asterisk 1.8.28-cert3, 11.6-cert8

Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2014-012-1.8.diff Asterisk
1.8
http://downloads.asterisk.org/pub/security/AST-2014-012-1.8.28.diff Certified
Asterisk
1.8.28
http://downloads.asterisk.org/pub/security/AST-2014-012-11.diff Asterisk
11
http://downloads.asterisk.org/pub/security/AST-2014-012-11.6.diff Certified
Asterisk
11.6
http://downloads.asterisk.org/pub/security/AST-2014-012-12.diff Asterisk
12
http://downloads.asterisk.org/pub/security/AST-2014-012-13.diff Asterisk
13

Links https://issues.asterisk.org/jira/browse/ASTERISK-24469

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2014-012.pdf and
http://downloads.digium.com/pub/security/AST-2014-012.html

Revision History
Date Editor Revisions Made
5 November, 2014 Mark Michelson Initial Advisory created

Asterisk Project Security Advisory – AST-2014-012
Copyright (c) 2014 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.