AST-2014-008: Denial of Service in PJSIP Channel Driver Subscriptions

Asterisk Project Security Advisory - AST-2014-008

         Product        Asterisk
         Summary        Denial of Service in PJSIP Channel Driver
                        Subscriptions
    Nature of Advisory  Denial of Service
      Susceptibility    Remote authenticated sessions
         Severity       Moderate
      Exploits Known    No
       Reported On      28 May, 2014
       Reported By      Mark Michelson
        Posted On       June 12, 2014
     Last Updated On    June 12, 2014
     Advisory Contact   Mark Michelson <mmichelson AT digium DOT com>
         CVE Name       CVE-2014-4048

    Description  When a SIP transaction timeout caused a subscription to be
                 terminated, the action taken by Asterisk was guaranteed to
                 deadlock the thread on which SIP requests are serviced.

                 Note that this behavior could only happen on established
                 subscriptions, meaning that this could only be exploited if
                 an attacker bypassed authentication and successfully
                 subscribed to a real resource on the Asterisk server.

    Resolution  The socket-servicing thread is now no longer capable of
                dispatching synchronous tasks to other threads since that
                may result in deadlocks.

                               Affected Versions
                Product              Release Series
         Asterisk Open Source             12.x       All versions

                                  Corrected In
                     Product                              Release
               Asterisk Open Source                        12.3.1

                                    Patches
                               SVN URL                              Revision
   http://downloads.asterisk.org/pub/security/AST-2014-008-12.diff Asterisk
                                                                   12

       Links     https://issues.asterisk.org/jira/browse/ASTERISK-23802

    Asterisk Project Security Advisories are posted at
    http://www.asterisk.org/security

    This document may be superseded by later versions; if so, the latest
    version will be posted at
    http://downloads.digium.com/pub/security/AST-2014-008.pdf and
    http://downloads.digium.com/pub/security/AST-2014-008.html

                                Revision History
          Date                  Editor                 Revisions Made
    June 6, 2014       Mark Michelson            Document Creation
    June 12, 2014      Matt Jordan               Added CVE

               Asterisk Project Security Advisory - AST-2014-008
              Copyright (c) 2014 Digium, Inc. All Rights Reserved.
  Permission is hereby granted to distribute and publish this advisory in its
                           original, unaltered form.