Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11]) by www.NetBSD.org (Postfix) with ESMTP id CEFCB63B873 for ; Fri, 21 Jan 2011 05:13:15 +0000 (UTC) Received: by mail.netbsd.org (Postfix, from userid 605) id 9505519D1A9; Fri, 21 Jan 2011 05:13:15 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 75A3E19D196 for ; Fri, 21 Jan 2011 05:13:13 +0000 (UTC) X-Virus-Scanned: amavisd-new at NetBSD.org Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.NetBSD.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id Wue+TyXb9Orx for ; Fri, 21 Jan 2011 05:13:12 +0000 (UTC) Received: from cvs.netbsd.org (cvs.NetBSD.org [IPv6:2001:4f8:3:7:2e0:81ff:fe30:95bd]) by mail.netbsd.org (Postfix) with ESMTP id 90F2019D192 for ; Fri, 21 Jan 2011 05:13:12 +0000 (UTC) Received: by cvs.netbsd.org (Postfix, from userid 500) id 7EB88175DD; Fri, 21 Jan 2011 05:13:12 +0000 (UTC) MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Date: Fri, 21 Jan 2011 05:13:12 +0000 From: "John Nemeth" Subject: CVS commit: pkgsrc/comms/asterisk16 To: pkgsrc-changes@NetBSD.org Reply-To: jnemeth@netbsd.org X-Mailer: log_accum Message-Id: <20110121051312.7EB88175DD@cvs.netbsd.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk Module Name: pkgsrc Committed By: jnemeth Date: Fri Jan 21 05:13:12 UTC 2011 Modified Files: pkgsrc/comms/asterisk16: Makefile distinfo Log Message: Update to 1.6.2.16.1 This is to fix AST-2011-001: Stack buffer overflow in SIP channel driver Asterisk Project Security Advisory - AST-2011-001 Product Asterisk Summary Stack buffer overflow in SIP channel driver Nature of Advisory Exploitable Stack Buffer Overflow Susceptibility Remote Authenticated Sessions Severity Moderate Exploits Known No Reported On January 11, 2011 Reported By Matthew Nicholson Posted On January 18, 2011 Last Updated On January 18, 2011 Advisory Contact Matthew Nicholson CVE Name Description When forming an outgoing SIP request while in pedantic mode, a stack buffer can be made to overflow if supplied with carefully crafted caller ID information. This vulnerability also affects the URIENCODE dialplan function and in some versions of asterisk, the AGI dialplan application as well. The ast_uri_encode function does not properly respect the size of its output buffer and can write past the end of it when encoding URIs. For full details, see: http://downloads.digium.com/pub/security/AST-2011-001.html To generate a diff of this commit: cvs rdiff -u -r1.28 -r1.29 pkgsrc/comms/asterisk16/Makefile cvs rdiff -u -r1.19 -r1.20 pkgsrc/comms/asterisk16/distinfo Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.