[Secure-testing-team] Bug#704114: asterisk: asterisk security advisories: AST-2013-001 / AST-2013-002 / AST-2013-003

[Salvatore Bonaccorso]

Package: asterisk
Severity: grave
Tags: security patch upstream

Hi,

the following vulnerabilities were published for asterisk.

CVE-2013-2685[0]:
Buffer Overflow Exploit Through SIP SDP Header

CVE-2013-2686[1]:
Denial of Service in HTTP server

CVE-2013-2264[2]:
Username disclosure in SIP channel driver

For CVE-2013-2685 the tracker[3] mentions only 1.11.x. Could you
doublecheck that squeeze, testing and wheezy are not affected?

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] http://security-tracker.debian.org/tracker/CVE-2013-2685
    http://downloads.asterisk.org/pub/security/AST-2013-001.html
[1] http://security-tracker.debian.org/tracker/CVE-2013-2686
    http://downloads.asterisk.org/pub/security/AST-2013-002.html
[2] http://security-tracker.debian.org/tracker/CVE-2013-2264
    http://downloads.asterisk.org/pub/security/AST-2013-003.html
[3] https://issues.asterisk.org/jira/browse/ASTERISK-20901

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore