Tag : project security

Heap Buffer Overflow in Skinny Channel Driver

Posted April 23, 2012 by Pavel Espinal & filed under VoIP News Comments: 0.

Tags: asterisk, attacker, buffer overflow, button, Driver, heap, history date, linkedin, matt jordan, open source, Overflow, project security, source

In the Skinny channel driver, KEYPAD_BUTTON_MESSAGE events are queued for processing in a buffer allocated on the heap, where each DTMF value that is received is placed on the end of the buffer. Since the length of the buffer is never checked,..

Read more

Remote crash possibility with SIP and the “automon” feature enabled

Posted December 8, 2011 by Pavel Espinal & filed under VoIP News Comments: 0.

Tags: asterisk, asterisk download, Digium, linkedin, null pointer, project security, Remote, Security, security advisories, security advisory, sip, sip to sip

Asterisk Project Security Advisory – AST-2011-014Summary:      Remote crash possibility with SIP and the automonDescription:  When the automon feature is enabled in features.conf, it is possible to send a sequence of SIP requests that cause Aster..

Read more