AST-2014-002: Denial of Service Through File Descriptor Exhaustion with chan_sip Session-Timers

           Asterisk Project Security Advisory - AST-2014-002

     Product        Asterisk                                              
     Summary        Denial of Service Through File Descriptor Exhaustion  
                    with chan_sip Session-Timers                          
Nature of Advisory  Denial of Service                                     
  Susceptibility    Remote Authenticated or Anonymous Sessions            
     Severity       Moderate                                              
  Exploits Known    No                                                    
   Reported On      2014/02/25                                            
   Reported By      Corey Farrell                                         
    Posted On       March 10, 2014                                        
 Last Updated On    March 10, 2014                                        
 Advisory Contact   Kinsey Moore <kmoore AT digium DOT com>               
     CVE Name       CVE-2014-2287                                         

Description  An attacker can use all available file descriptors using     
             SIP INVITE requests.                                         
                                                                          
             Knowledge required to achieve the attack:                    
                                                                          
             * Valid account credentials or anonymous dial in             
                                                                          
             * A valid extension that can be dialed from the SIP account  
                                                                          
             Trigger conditions:                                          
                                                                          
             * chan_sip configured with "session-timers" set to           
             "originate" or "accept"                                      
                                                                          
             ** The INVITE request must contain either a Session-Expires  
             or a Min-SE header with malformed values or values           
             disallowed by the system's configuration.                    
                                                                          
             * chan_sip configured with "session-timers" set to "refuse"  
                                                                          
             ** The INVITE request must offer "timer" in the "Supported"  
             header                                                       
                                                                          
             Asterisk will respond with code 400, 420, or 422 for         
             INVITEs meeting this criteria. Each INVITE meeting these     
             conditions will leak a channel and several file              
             descriptors. The file descriptors cannot be released         
             without restarting Asterisk which may allow intrusion        
             detection systems to be bypassed by sending the requests     
             slowly.                                                      

Resolution  Upgrade to a version with the patch integrated or apply the   
            appropriate patch.                                            

                           Affected Versions
             Product               Release Series  
      Asterisk Open Source             1.8.x       All                    
      Asterisk Open Source              11.x       All                    
      Asterisk Open Source              12.x       All                    
       Certified Asterisk              1.8.15      All                    
       Certified Asterisk               11.6       All                    

                              Corrected In  
                 Product                              Release             
        Asterisk Open Source 1.8.x                    1.8.26.1            
        Asterisk Open Source 11.x                      11.8.1             
        Asterisk Open Source 12.x                      12.1.1             
        Certified Asterisk 1.8.15                   1.8.15-cert5          
         Certified Asterisk 11.6                     11.6-cert2           

                                  Patches                          
                             SVN URL                               Revision  

http://downloads.asterisk.org/pub/security/AST-2014-002-1.8.diff Asterisk
1.8
http://downloads.asterisk.org/pub/security/AST-2014-002-11.diff Asterisk
11
http://downloads.asterisk.org/pub/security/AST-2014-002-12.diff Asterisk
12
http://downloads.asterisk.org/pub/security/AST-2014-002-11.6.diff Asterisk
11.6
Certified
http://downloads.asterisk.org/pub/security/AST-2014-002-1.8.15.diff Asterisk
1.8.15
Certified

   Links     https://issues.asterisk.org/jira/browse/ASTERISK-23373       

Asterisk Project Security Advisories are posted at                        
http://www.asterisk.org/security                                          
                                                                          
This document may be superseded by later versions; if so, the latest      
version will be posted at                                                 
http://downloads.digium.com/pub/security/AST-2014-002.pdf and             
http://downloads.digium.com/pub/security/AST-2014-002.html                

                            Revision History
    Date           Editor                    Revisions Made               
2014/03/04     Kinsey Moore     Document Creation                         
2014/03/06     Kinsey Moore     Corrections and Wording Clarification     
2014/03/10     Kinsey Moore     Added missing patch links                 

           Asterisk Project Security Advisory - AST-2014-002
          Copyright (c) 2014 Digium, Inc. All Rights Reserved.

Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.