Advisories » MGASA-2015-0153

Updated asterisk packages fix CVE-2015-3008

Publication date: 15 Apr 2015
Modification date: 15 Apr 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2015-3008

Description

Updated asterisk packages fix security vulnerability:

When Asterisk registers to a SIP TLS device and and verifies the server,
Asterisk will accept signed certificates that match a common name other than
the one Asterisk is expecting if the signed certificate has a common name
containing a null byte after the portion of the common name that Asterisk
expected (CVE-2015-3008).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=15674
• http://downloads.asterisk.org/pub/security/AST-2015-003.html
• http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.17.1
• http://downloads.asterisk.org/pub/telephony/asterisk/asterisk-11.17.1-summary.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3008

SRPMS

4/core

• asterisk-11.17.1-1.mga4