Update:
On Fri, Aug 25, 2006 at 12:50:54PM +0300, Tzafrir Cohen wrote:
> Hi
>
> I'm trying to figure out
> http://labs.musecurity.com/advisories/MU-200608-01.txt
>
> There are two issues here:
>
> 1. An issues in the MGCP channel. As I have not examined it, I must
> assume that it also affects the version in Sage until proven otherwise.
> This is also remotely exploitable. Note that most people don't use mgcp,
> and the MGCP channel of Asterisk is partially broken. I'm not sure if by
> with a default configuration the MGCP channel will manage to bind on a
> port at all.
dpatch attached. Untested yet.
>
> 2. A format string issue with Record(). Probably in Sarge as well. Not
> in the default configuration.
Seems to be purely a configuration issue. No code change involved. The
only format interpreted in the filename is a harmless %d.
--
Tzafrir Cohen sip:tzafrir@xxxxxxxxxxxxxxxx
icq#16849755 iax:tzafrir@xxxxxxxxxxxxxxxx
+972-50-7952406 jabber:tzafrir@xxxxxxxxxx
tzafrir.cohen@xxxxxxxxxx http://www.xorcom.com
chan_mgcp_fix.dpatch
Description: Text document
_______________________________________________
Pkg-voip-maintainers mailing list
Pkg-voip-maintainers@xxxxxxxxxxxxxxxxxxxxxxx
http://lists.alioth.debian.org/mailman/listinfo/pkg-voip-maintainers
| 
