jetlib.sec » Tags » project-security

Feeds

133445 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

45 items tagged "project security"

Related tags: stack buffer [+], manager interface [+], malformed request [+], asterisk [+], window of time [+], user [+], sip [+], shell commands [+], service vulnerability [+], segmentation fault [+], rport [+], pedantic mode [+], null pointer [+], nat force [+], nat [+], buffer overflow [+], buffer [+], attacker [+], ast [+], arrays [+], project [+], security [+], txt [+], sdp [+], host access [+], field [+], faxmaxdatagram [+], cidr notation [+], access [+], security advisory [+], wildcard [+], security workshop [+], honeynet project [+], dialplan [+]

• April 23, 2012
• 16:07

  Asterisk Project Security Advisory - AST-2012-006

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - A remotely exploitable crash vulnerability exists in the SIP channel driver if a SIP UPDATE request is processed within a particular window of time.

  Tags:  project security asterisk project-security security-advisory window-of-time  

• 16:07

  Asterisk Project Security Advisory - AST-2012-006

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - A remotely exploitable crash vulnerability exists in the SIP channel driver if a SIP UPDATE request is processed within a particular window of time.

  Tags:  project security asterisk project-security security-advisory window-of-time  

• 16:07

  Asterisk Project Security Advisory - AST-2012-006

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - A remotely exploitable crash vulnerability exists in the SIP channel driver if a SIP UPDATE request is processed within a particular window of time.

  Tags:  project security asterisk project-security security-advisory window-of-time  

• 16:06

  Asterisk Project Security Advisory - AST-2012-005

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - In the Skinny channel driver, KEYPAD_BUTTON_MESSAGE events are queued for processing in a buffer allocated on the heap, where each DTMF value that is received is placed on the end of the buffer. Since the length of the buffer is never checked, an attacker could send sufficient KEYPAD_BUTTON_MESSAGE events such that the buffer is overrun.

  Tags:  project asterisk buffer project-security security-advisory attacker  

• 16:06

  Asterisk Project Security Advisory - AST-2012-005

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - In the Skinny channel driver, KEYPAD_BUTTON_MESSAGE events are queued for processing in a buffer allocated on the heap, where each DTMF value that is received is placed on the end of the buffer. Since the length of the buffer is never checked, an attacker could send sufficient KEYPAD_BUTTON_MESSAGE events such that the buffer is overrun.

  Tags:  project asterisk buffer project-security security-advisory attacker  

• 16:06

  Asterisk Project Security Advisory - AST-2012-005

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - In the Skinny channel driver, KEYPAD_BUTTON_MESSAGE events are queued for processing in a buffer allocated on the heap, where each DTMF value that is received is placed on the end of the buffer. Since the length of the buffer is never checked, an attacker could send sufficient KEYPAD_BUTTON_MESSAGE events such that the buffer is overrun.

  Tags:  project asterisk buffer project-security security-advisory attacker  

• 16:04

  Asterisk Project Security Advisory - AST-2012-004

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - A user of the Asterisk Manager Interface can bypass a security check and execute shell commands when they lack permission to do so. Under normal conditions, a user should only be able to run shell commands if that user has System class authorization. Users could bypass this restriction by using the MixMonitor application with the originate action or by using either the GetVar or Status manager actions in combination with the SHELL and EVAL functions. The patch adds checks in each affected action to verify if a user has System class authorization. If the user does not have those authorizations, Asterisk rejects the action if it detects the use of any functions or applications that run system commands.

  Tags:  user security asterisk manager-interface shell-commands project-security  

• 16:04

  Asterisk Project Security Advisory - AST-2012-004

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - A user of the Asterisk Manager Interface can bypass a security check and execute shell commands when they lack permission to do so. Under normal conditions, a user should only be able to run shell commands if that user has System class authorization. Users could bypass this restriction by using the MixMonitor application with the originate action or by using either the GetVar or Status manager actions in combination with the SHELL and EVAL functions. The patch adds checks in each affected action to verify if a user has System class authorization. If the user does not have those authorizations, Asterisk rejects the action if it detects the use of any functions or applications that run system commands.

  Tags:  user security asterisk manager-interface shell-commands project-security  

• 16:04

  Asterisk Project Security Advisory - AST-2012-004

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - A user of the Asterisk Manager Interface can bypass a security check and execute shell commands when they lack permission to do so. Under normal conditions, a user should only be able to run shell commands if that user has System class authorization. Users could bypass this restriction by using the MixMonitor application with the originate action or by using either the GetVar or Status manager actions in combination with the SHELL and EVAL functions. The patch adds checks in each affected action to verify if a user has System class authorization. If the user does not have those authorizations, Asterisk rejects the action if it detects the use of any functions or applications that run system commands.

  Tags:  user security asterisk manager-interface shell-commands project-security  

• March 15, 2012
• 20:05

  Asterisk Project Security Advisory - AST-2012-002

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - Asterisk suffers from an exploitable stack buffer overflow with locally defined data.

  Tags:  project security asterisk stack-buffer buffer-overflow project-security  

• 20:05

  Asterisk Project Security Advisory - AST-2012-002

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - Asterisk suffers from an exploitable stack buffer overflow with locally defined data.

  Tags:  project security asterisk stack-buffer buffer-overflow project-security  

• 20:05

  Asterisk Project Security Advisory - AST-2012-002

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - Asterisk suffers from an exploitable stack buffer overflow with locally defined data.

  Tags:  project security asterisk stack-buffer buffer-overflow project-security  

• February 16, 2012
• 8:00

  Bugtraq: 2012 Honeynet Project Security Workshop

   » ‎ SecurityFocus Vulnerabilities
  2012 Honeynet Project Security Workshop

  Tags:  honeynet-project security-workshop project-security  

• December 09, 2011
• 9:22

  Asterisk Project Security Advisory - AST-2011-013

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - It is possible to enumerate SIP usernames when the general and user/peer NAT settings differ in whether to respond to the port a request is sent from or the port listed for responses in the Via header. In 1.4 and 1.6.2, this would mean if one setting was nat=yes or nat=route and the other was either nat=no or nat=never. In 1.8 and 10, this would mean when one was nat=force_rport or nat=yes and the other was nat=no or nat=comedia.

  Tags:  project nat asterisk nat-force project-security rport  

• 9:22

  Asterisk Project Security Advisory - AST-2011-013

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - It is possible to enumerate SIP usernames when the general and user/peer NAT settings differ in whether to respond to the port a request is sent from or the port listed for responses in the Via header. In 1.4 and 1.6.2, this would mean if one setting was nat=yes or nat=route and the other was either nat=no or nat=never. In 1.8 and 10, this would mean when one was nat=force_rport or nat=yes and the other was nat=no or nat=comedia.

  Tags:  project nat asterisk nat-force project-security rport  

• 9:22

  Asterisk Project Security Advisory - AST-2011-013

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - It is possible to enumerate SIP usernames when the general and user/peer NAT settings differ in whether to respond to the port a request is sent from or the port listed for responses in the Via header. In 1.4 and 1.6.2, this would mean if one setting was nat=yes or nat=route and the other was either nat=no or nat=never. In 1.8 and 10, this would mean when one was nat=force_rport or nat=yes and the other was nat=no or nat=comedia.

  Tags:  project nat asterisk nat-force project-security rport  

• December 08, 2011
• 16:11

  Asterisk Project Security Advisory - AST-2011-014

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - Asterisk suffers from a denial of service vulnerability. When the "automon" feature is enabled in features.conf, it is possible to send a sequence of SIP requests that cause Asterisk to dereference a NULL pointer and crash.

  Tags:  project security asterisk service-vulnerability null-pointer project-security  

• 16:11

  Asterisk Project Security Advisory - AST-2011-014

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - Asterisk suffers from a denial of service vulnerability. When the "automon" feature is enabled in features.conf, it is possible to send a sequence of SIP requests that cause Asterisk to dereference a NULL pointer and crash.

  Tags:  project security asterisk service-vulnerability null-pointer project-security  

• 16:11

  Asterisk Project Security Advisory - AST-2011-014

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - Asterisk suffers from a denial of service vulnerability. When the "automon" feature is enabled in features.conf, it is possible to send a sequence of SIP requests that cause Asterisk to dereference a NULL pointer and crash.

  Tags:  project security asterisk service-vulnerability null-pointer project-security  

• October 17, 2011
• 14:47

  Asterisk Project Security Advisory - AST-2011-012

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - The SIP channel driver allows a remote authenticated user that ability to cause a crash with a malformed request due to an uninitialized variable.

  Tags:  project security asterisk project-security malformed-request security-advisory  

• 14:47

  Asterisk Project Security Advisory - AST-2011-012

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - The SIP channel driver allows a remote authenticated user that ability to cause a crash with a malformed request due to an uninitialized variable.

  Tags:  project security asterisk project-security malformed-request security-advisory  

• 14:47

  Asterisk Project Security Advisory - AST-2011-012

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - The SIP channel driver allows a remote authenticated user that ability to cause a crash with a malformed request due to an uninitialized variable.

  Tags:  project security asterisk project-security malformed-request security-advisory  

• 14:47

  Asterisk Project Security Advisory - AST-2011-012

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - The SIP channel driver allows a remote authenticated user that ability to cause a crash with a malformed request due to an uninitialized variable.

  Tags:  project security asterisk project-security malformed-request security-advisory  

• 14:47

  Asterisk Project Security Advisory - AST-2011-012

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - The SIP channel driver allows a remote authenticated user that ability to cause a crash with a malformed request due to an uninitialized variable.

  Tags:  project security asterisk project-security malformed-request security-advisory  

• 14:47

  Asterisk Project Security Advisory - AST-2011-012

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - The SIP channel driver allows a remote authenticated user that ability to cause a crash with a malformed request due to an uninitialized variable.

  Tags:  project security asterisk project-security malformed-request security-advisory  

• June 28, 2011
• 19:00

  Asterisk Project Security Advisory - AST-2011-011

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - Asterisk may respond differently to SIP requests from an invalid SIP user than it does to a user configured on the system, even when the alwaysauthreject option is set in the configuration. This can leak information about what SIP users are valid on the Asterisk system.

  Tags:  project sip asterisk project-security security-advisory  

• 19:00

  Asterisk Project Security Advisory - AST-2011-011

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - Asterisk may respond differently to SIP requests from an invalid SIP user than it does to a user configured on the system, even when the alwaysauthreject option is set in the configuration. This can leak information about what SIP users are valid on the Asterisk system.

  Tags:  project sip asterisk project-security security-advisory  

• 19:00

  Asterisk Project Security Advisory - AST-2011-011

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - Asterisk may respond differently to SIP requests from an invalid SIP user than it does to a user configured on the system, even when the alwaysauthreject option is set in the configuration. This can leak information about what SIP users are valid on the Asterisk system.

  Tags:  project sip asterisk project-security security-advisory  

• June 02, 2011
• 21:39

  Asterisk Project Security Advisory - AST-2011-007

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - If a remote user initiates a SIP call and the recipient picks up, the remote user can reply with a malformed Contact header that Asterisk will improperly handle and cause a crash due to a segmentation fault.

  Tags:  project security asterisk segmentation-fault project-security security-advisory  

• 21:39

  Asterisk Project Security Advisory - AST-2011-007

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - If a remote user initiates a SIP call and the recipient picks up, the remote user can reply with a malformed Contact header that Asterisk will improperly handle and cause a crash due to a segmentation fault.

  Tags:  project security asterisk segmentation-fault project-security security-advisory  

• 21:39

  Asterisk Project Security Advisory - AST-2011-007

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - If a remote user initiates a SIP call and the recipient picks up, the remote user can reply with a malformed Contact header that Asterisk will improperly handle and cause a crash due to a segmentation fault.

  Tags:  project security asterisk segmentation-fault project-security security-advisory  

• April 21, 2011
• 16:58

  Asterisk Project Security Advisory - AST-2011-005

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - On systems that have the Asterisk Manager Interface, Skinny, SIP over TCP, or the built in HTTP server enabled, it is possible for an attacker to open as many connections to asterisk as he wishes. This will cause Asterisk to run out of available file descriptors and stop processing any new calls. Additionally, disk space can be exhausted as Asterisk logs failures to open new file descriptors.

  Tags:  project security asterisk manager-interface project-security security-advisory  

• 16:58

  Asterisk Project Security Advisory - AST-2011-005

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - On systems that have the Asterisk Manager Interface, Skinny, SIP over TCP, or the built in HTTP server enabled, it is possible for an attacker to open as many connections to asterisk as he wishes. This will cause Asterisk to run out of available file descriptors and stop processing any new calls. Additionally, disk space can be exhausted as Asterisk logs failures to open new file descriptors.

  Tags:  project security asterisk manager-interface project-security security-advisory  

• 16:58

  Asterisk Project Security Advisory - AST-2011-005

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - On systems that have the Asterisk Manager Interface, Skinny, SIP over TCP, or the built in HTTP server enabled, it is possible for an attacker to open as many connections to asterisk as he wishes. This will cause Asterisk to run out of available file descriptors and stop processing any new calls. Additionally, disk space can be exhausted as Asterisk logs failures to open new file descriptors.

  Tags:  project security asterisk manager-interface project-security security-advisory  

• February 22, 2011
• 15:06

  Asterisk Project Security Advisory - AST-2011-002

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - When decoding UDPTL packets, multiple stack and heap based arrays can be made to overflow by specially crafted packets. Systems doing T.38 pass through or termination are vulnerable.

  Tags:  project security asterisk project-security security-advisory arrays  

• 15:06

  Asterisk Project Security Advisory - AST-2011-002

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - When decoding UDPTL packets, multiple stack and heap based arrays can be made to overflow by specially crafted packets. Systems doing T.38 pass through or termination are vulnerable.

  Tags:  project security asterisk project-security security-advisory arrays  

• 15:06

  Asterisk Project Security Advisory - AST-2011-002

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - When decoding UDPTL packets, multiple stack and heap based arrays can be made to overflow by specially crafted packets. Systems doing T.38 pass through or termination are vulnerable.

  Tags:  project security asterisk project-security security-advisory arrays  

• January 18, 2011
• 13:23

  Asterisk Project Security Advisory - AST-2011-001

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - When forming an outgoing SIP request while in pedantic mode, a stack buffer can be made to overflow if supplied with carefully crafted caller ID information. This vulnerability also affects the URIENCODE dialplan function and in some versions of asterisk, the AGI dialplan application as well. The ast_uri_encode function does not properly respect the size of its output buffer and can write past the end of it when encoding URIs.

  Tags:  project security asterisk stack-buffer pedantic-mode project-security  

• 13:23

  Asterisk Project Security Advisory - AST-2011-001

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - When forming an outgoing SIP request while in pedantic mode, a stack buffer can be made to overflow if supplied with carefully crafted caller ID information. This vulnerability also affects the URIENCODE dialplan function and in some versions of asterisk, the AGI dialplan application as well. The ast_uri_encode function does not properly respect the size of its output buffer and can write past the end of it when encoding URIs.

  Tags:  project security asterisk stack-buffer pedantic-mode project-security  

• 13:23

  Asterisk Project Security Advisory - AST-2011-001

   » ‎ Packet Storm Security Misc. Files
  Asterisk Project Security Advisory - When forming an outgoing SIP request while in pedantic mode, a stack buffer can be made to overflow if supplied with carefully crafted caller ID information. This vulnerability also affects the URIENCODE dialplan function and in some versions of asterisk, the AGI dialplan application as well. The ast_uri_encode function does not properly respect the size of its output buffer and can write past the end of it when encoding URIs.

  Tags:  project security asterisk stack-buffer pedantic-mode project-security  

• February 26, 2010
• 12:00

  AST-2010-003.txt

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - Host access rules using permit= and deny= configurations behave unpredictably if the CIDR notation /0 is used. Depending on the system's behavior, this may act as desired, but in other cases it might not, thereby allowing access from hosts that should be denied.

  Tags:  txt access ast cidr-notation project-security host-access  

• 12:00

  AST-2010-003.txt

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - Host access rules using permit= and deny= configurations behave unpredictably if the CIDR notation /0 is used. Depending on the system's behavior, this may act as desired, but in other cases it might not, thereby allowing access from hosts that should be denied.

  Tags:  txt access ast cidr-notation project-security host-access  

• February 20, 2010
• 11:00

  AST-2010-002.txt

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - A common usage of the ${EXTEN} channel variable in a dialplan with wildcard pattern matches can lead to a possible string injection vulnerability. By having a wildcard match in a dialplan, it is possible to allow unintended calls to be executed.

  Tags:  ast dialplan wildcard project-security security-advisory  

• February 02, 2010
• 21:00

  AST-2010-001.txt

   » ‎ Packet Storm Security Recent Files
  Asterisk Project Security Advisory - An attacker attempting to negotiate T.38 over SIP can remotely crash Asterisk by modifying the FaxMaxDatagram field of the SDP to contain either a negative or exceptionally large value. The same crash occurs when the FaxMaxDatagram field is omitted from the SDP as well.

  Tags:  faxmaxdatagram asterisk field project-security sdp security-advisory  

• 21:00

  AST-2010-001.txt

   » ‎ Packet Storm Security Advisories
  Asterisk Project Security Advisory - An attacker attempting to negotiate T.38 over SIP can remotely crash Asterisk by modifying the FaxMaxDatagram field of the SDP to contain either a negative or exceptionally large value. The same crash occurs when the FaxMaxDatagram field is omitted from the SDP as well.

  Tags:  faxmaxdatagram asterisk field project-security sdp security-advisory