Your message dated Fri, 02 Jun 2017 09:04:08 +0000 with message-id <[email protected]> and subject line Bug#863901: fixed in pjproject 2.5.5~dfsg-6 has caused the Debian Bug report #863901, regarding AST-2017-002: Buffer Overrun in PJSIP transaction layer to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 863901: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863901 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: src:pjproject Version: 2.5.5~dfsg-5 Severity: critical Tags: security patch The following security advisory has been announced by the Asterisk project for the third party pjproject library. A patch is available. Asterisk Project Security Advisory - AST-2017-002 Product Asterisk Summary Buffer Overrun in PJSIP transaction layer Nature of Advisory Buffer Overrun/Crash Susceptibility Remote Unauthenticated Sessions Severity Critical Exploits Known No Reported On 12 April, 2017 Reported By Sandro Gauci Posted On Last Updated On April 13, 2017 Advisory Contact Mark Michelson <mark DOT michelson AT digium DOT com> CVE Name Description A remote crash can be triggered by sending a SIP packet to Asterisk with a specially crafted CSeq header and a Via header with no branch parameter. The issue is that the PJSIP RFC 2543 transaction key generation algorithm does not allocate a large enough buffer. By overrunning the buffer, the memory allocation table becomes corrupted, leading to an eventual crash. This issue is in PJSIP, and so the issue can be fixed without performing an upgrade of Asterisk at all. However, we are releasing a new version of Asterisk with the bundled PJProject updated to include the fix. If you are running Asterisk with chan_sip, this issue does not affect you. Resolution A patch created by the Asterisk team has been submitted and accepted by the PJProject maintainers. Affected Versions Product Release Series Asterisk Open Source 11.x Unaffected Asterisk Open Source 13.x All versions Asterisk Open Source 14.x All versions Certified Asterisk 13.13 All versions Corrected In Product Release Asterisk Open Source 13.15.1, 14.4.1 Certified Asterisk 13.13-cert4 Patches SVN URL Revision Links https://issues.asterisk.org/jira/browse/ASTERISK-26938 Asterisk Project Security Advisories are posted at http://www.asterisk.org/security This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2017-002.pdf and http://downloads.digium.com/pub/security/AST-2017-002.html Revision History Date Editor Revisions Made 12 April, 2017 Mark Michelson Initial report created Asterisk Project Security Advisory - AST-2017-002 Copyright (c) 2017 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form.
--- End Message ---
--- Begin Message ---Source: pjproject Source-Version: 2.5.5~dfsg-6 We believe that the bug you reported is fixed in the latest version of pjproject, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Bernhard Schmidt <[email protected]> (supplier of updated pjproject package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Fri, 02 Jun 2017 08:59:42 +0200 Source: pjproject Binary: libpjlib-util2 libpjmedia-audiodev2 libpjmedia-codec2 libpjmedia-videodev2 libpjmedia2 libpjnath2 libpjsip-simple2 libpjsip-ua2 libpjsip2 libpjsua2 libpjsua2-2v5 libpj2 libpjproject-dev python-pjproject Architecture: source Version: 2.5.5~dfsg-6 Distribution: unstable Urgency: high Maintainer: Debian VoIP Team <[email protected]> Changed-By: Bernhard Schmidt <[email protected]> Description: libpj2 - PJ Project - PJProject core libraries libpjlib-util2 - PJ Project - helper utilities libpjmedia-audiodev2 - PJ Project - Audio devices libpjmedia-codec2 - PJ Project - Multimedia codecs handling libpjmedia-videodev2 - SIP handling library - video devices libpjmedia2 - PJ Project - VoIP media libpjnath2 - PJ Project - NAT handling libpjproject-dev - PJ Project - development headers libpjsip-simple2 - PJ Project - SIP SIMPLE instant messaging libpjsip-ua2 - SIP handling library - SIP user agent library libpjsip2 - PJ Project - SIP handling library libpjsua2 - PJ Project - Basic VoIP client library libpjsua2-2v5 - PJ Project - Basic VoIP client library python-pjproject - PJ Project - Python bindings Closes: 863901 863902 Changes: pjproject (2.5.5~dfsg-6) unstable; urgency=high . [ Tzafrir Cohen ] * add security patches published by the Asterisk project - AST-2017-002: Buffer Overrun in PJSIP transaction layer (Closes: #863901) - AST-2017-003: Crash in PJSIP multi-part body parser (Closes: #863902) Checksums-Sha1: dd7c583a88dfeb98292ec7b9cfc07b40b5d37648 3306 pjproject_2.5.5~dfsg-6.dsc aa0367ef2d2fddf62a5533d9a8d410c5b450f028 43188 pjproject_2.5.5~dfsg-6.debian.tar.xz 66350916ee0b4b1da023bc758069bd52e639c6cb 22024 pjproject_2.5.5~dfsg-6_amd64.buildinfo Checksums-Sha256: a7df9e73b4688b373d4397c1d0f440264671209e0127a8bce8d9309d14b8b476 3306 pjproject_2.5.5~dfsg-6.dsc 5cf61b65d7e9920a6c60d8e12934c20a395ad860e12f79f4e60ff70e3895053e 43188 pjproject_2.5.5~dfsg-6.debian.tar.xz 827b52f95ef7ebacc3965e23d4aabf4bd8ea649b988b44eb243a2c2ecdc83ca5 22024 pjproject_2.5.5~dfsg-6_amd64.buildinfo Files: d0579bf71839c0c2091d1feaddb54f2c 3306 comm optional pjproject_2.5.5~dfsg-6.dsc 84b4b9b6f47fb692f4f87110f3ca1118 43188 comm optional pjproject_2.5.5~dfsg-6.debian.tar.xz e4685696584e16a441249d18e0a1302d 22024 comm optional pjproject_2.5.5~dfsg-6_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQJFBAEBCAAvFiEE1uAexRal3873GVbTd1B55bhQvJMFAlkxF1sRHGJlcm5pQGRl Ymlhbi5vcmcACgkQd1B55bhQvJP3Jg/8DRXGgUOBcqVkRD2dKsGIEKE+kFHngUN2 VEg7dm8V0nl5r+SqxmPxBEcdn95Ipj9DUIktW3wtaYW+fdKxNQmHt+k3bVADNqTA PIN5IRbhXOohe7OFIbT6dQ5x7wYGxUhJqmLMF7bhlTZsMxiFRVnDFgrr+KWQzZ6Q KFikDGLPZhWBY/KG1XITPJxCuIWTuEKvPzLQ3Icjj1W8SjmtnUhUVaQspnqG9FgH PD15RIamZbFzlAtk76NJ8R/dCmoggc1LYBazfX085xJtLr7V914MBbGHGSqVRokp JvZZyJwzJS9nFmAmzOyjBZGjmvNCaqcrMmOXN73wEnrBLD/6qcgy+PFkxXuzTO5C K5mTSFfkkEVutF6hFJjsMI40OSTIwhYIZ6yTkdGLurVQDiXYOkfklZn7yWkXJWhB e422kkef71W2lLxqf4gbgkIn+dyzCAkIBsfSoyofNu6wLtqOIzhhyjPyN2FXU68B XIecoMUOiV+CrsYoLaqkyWtVxSgyAB8+Om864fO5PF7R3g4YzR9HSsYA5W2htfQw iIOEjvcM7iofVVrfhO/CmYLMGbteH39yrlV3NOx88PPtj4BQnKeghmwdYrf2XqFC HjCi+lfjK/1J/KgYE2ouPpG1sWiEuj8ypiHZBZsgWmdWQjxntGJ0jDd1vZR/TgYi Mt7ZCjTTUQY= =NB97 -----END PGP SIGNATURE-----
--- End Message ---
