MIME-Version: 1.0
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="US-ASCII"
Date: Tue, 25 Jan 2011 12:43:16 +0000
From: "Matthias Scheler" <tron@netbsd.org>
Subject: CVS commit: [pkgsrc-2010Q4] pkgsrc/comms/asterisk16
To: pkgsrc-changes@NetBSD.org
Reply-To: tron@netbsd.org
Message-Id: <20110125124316.EB889175DD@cvs.netbsd.org>
Sender: pkgsrc-changes-owner@NetBSD.org
Precedence: bulk

Module Name:	pkgsrc
Committed By:	tron
Date:		Tue Jan 25 12:43:16 UTC 2011

Modified Files:
	pkgsrc/comms/asterisk16 [pkgsrc-2010Q4]: Makefile distinfo
	pkgsrc/comms/asterisk16/patches [pkgsrc-2010Q4]: patch-aq

Log Message:
Pullup ticket #3335 - requested by gls
comms/asterisk16: security update

Revisions pulled up:
- comms/asterisk16/Makefile			1.28-1.29
- comms/asterisk16/distinfo			1.19-1.20
- comms/asterisk16/patches/patch-aq		1.10
---
Module Name:	pkgsrc
Committed By:	jnemeth
Date:		Sun Jan 16 06:30:57 UTC 2011

Modified Files:
	pkgsrc/comms/asterisk16: Makefile distinfo
	pkgsrc/comms/asterisk16/patches: patch-aq

Log Message:
Update to 1.6.2.16:

The release of Asterisk 1.6.2.16 resolves several issues reported by the
community and would have not been possible without your participation.
Thank you!

The following is a sample of the issues resolved in this release:

* Fix cache of device state changes for multiple servers.
   (Closes issue #18284, #18280. Reported, tested by klaus3000. Patched,
tested
   by russellb)

* Resolve issue where channel redirect function (CLI or AMI) hangs up
the call
   instead of redirecting the call.
   (Closes issue #18171. Reported by: SantaFox)
   (Closes issue #18185. Reported by: kwemheuer)
   (Closes issue #18211. Reported by: zahir_koradia)
   (Closes issue #18230. Reported by: vmarrone)
   (Closes issue #18299. Reported by: mbrevda)
   (Closes issue #18322. Reported by: nerbos)

* Linux and *BSD disagree on the elements within the ucred structure. Detect
   which one is in use on the system.
   (Closes issue #18384. Reported, patched, tested by bjm, tilghman)

* app_followme: Don't create a Local channel if the target extension
does not
   exist.
   (Closes issue #18126. Reported, patched by junky)

* Revert code that changed SSRC for DTMF.
   (Closes issue #17404, #18189, #18352. Reported by sdolloff, marcbou.
rsw686.
   Tested by cmbaker82)

* Resolve issue where REGISTER request with a Call-ID matching an existing
   transaction is received it was possible that the REGISTER request would
   overwrite the initreq of the private structure.
   (Closes issue #18051. Reported by eeman. Patched, tested by twilson)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.2.16
---
Module Name:	pkgsrc
Committed By:	jnemeth
Date:		Fri Jan 21 05:13:12 UTC 2011

Modified Files:
	pkgsrc/comms/asterisk16: Makefile distinfo

Log Message:
Update to 1.6.2.16.1

This is to fix AST-2011-001: Stack buffer overflow in SIP channel driver

               Asterisk Project Security Advisory - AST-2011-001

         Product        Asterisk
         Summary        Stack buffer overflow in SIP channel driver
    Nature of Advisory  Exploitable Stack Buffer Overflow
      Susceptibility    Remote Authenticated Sessions
         Severity       Moderate
      Exploits Known    No
       Reported On      January 11, 2011
       Reported By      Matthew Nicholson
        Posted On       January 18, 2011
     Last Updated On    January 18, 2011
     Advisory Contact   Matthew Nicholson <mnicholson at digium.com>
         CVE Name

   Description When forming an outgoing SIP request while in pedantic
mode, a
               stack buffer can be made to overflow if supplied with
               carefully crafted caller ID information. This vulnerability
               also affects the URIENCODE dialplan function and in some
               versions of asterisk, the AGI dialplan application as well..
               The ast_uri_encode function does not properly respect the
size
               of its output buffer and can write past the end of it when
               encoding URIs.

For full details, see:

http://downloads.digium.com/pub/security/AST-2011-001.html


To generate a diff of this commit:
cvs rdiff -u -r1.27 -r1.27.2.1 pkgsrc/comms/asterisk16/Makefile
cvs rdiff -u -r1.18 -r1.18.2.1 pkgsrc/comms/asterisk16/distinfo
cvs rdiff -u -r1.9 -r1.9.2.1 pkgsrc/comms/asterisk16/patches/patch-aq

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.