You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Automerge script ee20c58acc Multiple revisions 383977,383982 ... ........ r383977 | mjordan | 2013-03-27 09:36:22 -0500 (Wed, 27 Mar 2013) | 21 lines AST-2013-002: Prevent denial of service in HTTP server AST-2012-014, fixed in January of this year, contained a fix for Asterisk's HTTP server for a remotely-triggered crash. While the fix put in place fixed the possibility for the crash to be triggered, a denial of service vector still exists with that solution if an attacker sends one or more HTTP POST requests with very large Content-Length values. This patch resolves this by capping the Content-Length at 1024 bytes. Any attempt to send an HTTP POST with Content-Length greater than this cap will not result in any memory allocation. The POST will be responded to with an HTTP 413 "Request Entity Too Large" response. This issue was reported by Christoph Hebeisen of TELUS Security Labs (closes issue ASTERISK-20967) Reported by: Christoph Hebeisen patches: AST-2013-002-1.8.diff uploaded by mmichelson (License 5049) AST-2013-002-10.diff uploaded by mmichelson (License 5049) AST-2013-002-11.diff uploaded by mmichelson (License 5049) ........ r383982 | mjordan | 2013-03-27 09:55:16 -0500 (Wed, 27 Mar 2013) | 32 lines AST-2013-003: Prevent username disclosure in SIP channel driver When authenticating a SIP request with alwaysauthreject enabled, allowguest disabled, and autocreatepeer disabled, Asterisk discloses whether a user exists for INVITE, SUBSCRIBE, and REGISTER transactions in multiple ways. The information is disclosed when: * A "407 Proxy Authentication Required" response is sent instead of a "401 Unauthorized" response * The presence or absence of additional tags occurs at the end of "403 Forbidden" (such as "(Bad Auth)") * A "401 Unauthorized" response is sent instead of "403 Forbidden" response after a retransmission * Retransmission are sent when a matching peer did not exist, but not when a matching peer did exist. This patch resolves these various vectors by ensuring that the responses sent in all scenarios is the same, regardless of the presence of a matching peer. This issue was reported by Walter Doekes, OSSO B.V. A substantial portion of the testing and the solution to this problem was done by Walter as well - a huge thanks to his tireless efforts in finding all the ways in which this setting didn't work, providing automated tests, and working with Kinsey on getting this fixed. (closes issue ASTERISK-21013) Reported by: wdoekes Tested by: wdoekes, kmoore patches: AST-2013-003-1.8 uploaded by kmoore, wdoekes (License 6273, 5674) AST-2013-003-10 uploaded by kmoore, wdoekes (License 6273, 5674) AST-2013-003-11 uploaded by kmoore, wdoekes (License 6273, 5674) ........ Merged revisions 383977,383982 from file:///srv/subversion/repos/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/10-digiumphones@384025 65c4cc65-6c06-0410-ace0-fbb531ad65f3		13 years ago
..
editline	Multiple revisions 365155,365160,365299,365320,365399,365475,365478,365575,365632,365701,365898,365990,366049,366053,366106,366168,366241,366297,366390,366412,366591,366598,366741,366792,366881,366884,366948,367003,367028,367267,367299,367369,367417,367470,367562,367679,367731,367782,367844,367907,367978,367981,368042,368093,368267,368310,368407,368470,368499,368524,368536,368568,368587	14 years ago
stdtime	Multiple revisions 377136,377166,377212,377227,377241,377258,377261,377354,377382,377399,377432,377504,377510,377558,377592,377624,377656,377705,377709,377741,377772	13 years ago
Makefile	Merged revisions 372695 via svnmerge from	14 years ago
abstract_jb.c	Merged revisions 369005 via svnmerge from	14 years ago
acl.c	Merged revisions 369005 via svnmerge from	14 years ago
adsi.c	Merged revisions 369391 via svnmerge from	14 years ago
alaw.c	Merged revisions 369005 via svnmerge from	14 years ago
aoc.c	Multiple revisions 377838,377842,377848,377882,377923,377947,377992,378037,378089,378093,378120,378218,378286,378320	13 years ago
app.c	Merged revisions 375300 via svnmerge from	13 years ago
ast_expr2.c	Multiple revisions 360356-360357	14 years ago
ast_expr2.fl	Merged revisions 309808 via svnmerge from	15 years ago
ast_expr2.h	Multiple revisions 360356-360357	14 years ago
ast_expr2.y	Multiple revisions 360356-360357	14 years ago
ast_expr2f.c	Multiple revisions 360356-360357	14 years ago
asterisk.c	Merged revisions 379777 via svnmerge from	13 years ago
asterisk.dynamics	Remove the old stub files, preferring the optional_api method.	16 years ago
asterisk.exports.in	Merged revisions 288640 via svnmerge from	16 years ago
astfd.c	Merged revisions 369005 via svnmerge from	14 years ago
astmm.c	Multiple revisions 377136,377166,377212,377227,377241,377258,377261,377354,377382,377399,377432,377504,377510,377558,377592,377624,377656,377705,377709,377741,377772	13 years ago
astobj2.c	Merged revisions 373059,373062 via svnmerge from	14 years ago
audiohook.c	Merged revisions 369005 via svnmerge from	14 years ago
autochan.c	Merged revisions 369005 via svnmerge from	14 years ago
autoservice.c	Merged revisions 369005 via svnmerge from	14 years ago
bridging.c	Merged revisions 369709 via svnmerge from	14 years ago
buildinfo.c	…
callerid.c	Merged revisions 370643 via svnmerge from	14 years ago
ccss.c	Multiple revisions 377838,377842,377848,377882,377923,377947,377992,378037,378089,378093,378120,378218,378286,378320	13 years ago
cdr.c	Merged revisions 377070,377074 via svnmerge from	13 years ago
cel.c	Multiple revisions 377838,377842,377848,377882,377923,377947,377992,378037,378089,378093,378120,378218,378286,378320	13 years ago
channel.c	Multiple revisions 377838,377842,377848,377882,377923,377947,377992,378037,378089,378093,378120,378218,378286,378320	13 years ago
chanvars.c	Merged revisions 369005 via svnmerge from	14 years ago
cli.c	Merged revisions 377070,377074 via svnmerge from	13 years ago
config.c	Cleanup config cache on exit.	13 years ago
custom_control_frame.c	Update everything in the main directory for Digium phone additions.	14 years ago
cygload.c	…
data.c	Multiple revisions 377838,377842,377848,377882,377923,377947,377992,378037,378089,378093,378120,378218,378286,378320	13 years ago
datastore.c	Merged revisions 369005 via svnmerge from	14 years ago
db.c	Merged revisions 375759,375761 via svnmerge from	13 years ago
devicestate.c	Multiple revisions 377838,377842,377848,377882,377923,377947,377992,378037,378089,378093,378120,378218,378286,378320	13 years ago
dial.c	Merged revisions 369005 via svnmerge from	14 years ago
dns.c	Merged revisions 369005 via svnmerge from	14 years ago
dnsmgr.c	Multiple revisions 377136,377166,377212,377227,377241,377258,377261,377354,377382,377399,377432,377504,377510,377558,377592,377624,377656,377705,377709,377741,377772	13 years ago
dsp.c	Merged revisions 374476,374481 via svnmerge from	14 years ago
ecdisa.h	…
enum.c	Merged revisions 369005 via svnmerge from	14 years ago
event.c	Multiple revisions 377838,377842,377848,377882,377923,377947,377992,378037,378089,378093,378120,378218,378286,378320	13 years ago
features.c	Multiple revisions 377838,377842,377848,377882,377923,377947,377992,378037,378089,378093,378120,378218,378286,378320	13 years ago
file.c	Multiple revisions 377838,377842,377848,377882,377923,377947,377992,378037,378089,378093,378120,378218,378286,378320	13 years ago
fixedjitterbuf.c	Merged revisions 369005 via svnmerge from	14 years ago
fixedjitterbuf.h	…
format.c	Multiple revisions 377136,377166,377212,377227,377241,377258,377261,377354,377382,377399,377432,377504,377510,377558,377592,377624,377656,377705,377709,377741,377772	13 years ago
format_cap.c	Merged revisions 369005 via svnmerge from	14 years ago
format_pref.c	Merged revisions 375659 via svnmerge from	13 years ago
frame.c	Merged revisions 370430,370432 via svnmerge from	14 years ago
framehook.c	Merged revisions 369005 via svnmerge from	14 years ago
fskmodem.c	Merged revisions 369005 via svnmerge from	14 years ago
fskmodem_float.c	Merged revisions 369005 via svnmerge from	14 years ago
fskmodem_int.c	Merged revisions 369005 via svnmerge from	14 years ago
global_datastores.c	Merged revisions 369005 via svnmerge from	14 years ago
hashtab.c	Merged revisions 369005 via svnmerge from	14 years ago
heap.c	Merged revisions 369005 via svnmerge from	14 years ago
http.c	Multiple revisions 383977,383982	13 years ago
image.c	Multiple revisions 377838,377842,377848,377882,377923,377947,377992,378037,378089,378093,378120,378218,378286,378320	13 years ago
indications.c	Multiple revisions 377136,377166,377212,377227,377241,377258,377261,377354,377382,377399,377432,377504,377510,377558,377592,377624,377656,377705,377709,377741,377772	13 years ago
io.c	Merged revisions 369005 via svnmerge from	14 years ago
jitterbuf.c	Merged revisions 369005 via svnmerge from	14 years ago
loader.c	Multiple revisions 377838,377842,377848,377882,377923,377947,377992,378037,378089,378093,378120,378218,378286,378320	13 years ago
lock.c	Merged revisions 376587 via svnmerge from	13 years ago
logger.c	Multiple revisions 377136,377166,377212,377227,377241,377258,377261,377354,377382,377399,377432,377504,377510,377558,377592,377624,377656,377705,377709,377741,377772	13 years ago
manager.c	Merged revisions 376726 via svnmerge from	13 years ago
md5.c	Multiple revisions 368721,368739,368760,368808	14 years ago
message.c	Merged revisions 374210 via svnmerge from	14 years ago
netsock.c	Merged revisions 369005 via svnmerge from	14 years ago
netsock2.c	Merged revisions 369109 via svnmerge from	14 years ago
pbx.c	Fix compile error, due to different var names on merge.	13 years ago
plc.c	Merged revisions 369005 via svnmerge from	14 years ago
poll.c	Merged revisions 285268 via svnmerge from	16 years ago
presencestate.c	Update everything in the main directory for Digium phone additions.	14 years ago
privacy.c	Merged revisions 369005 via svnmerge from	14 years ago
rtp_engine.c	Merged revisions 375995 via svnmerge from	13 years ago
say.c	Merged revisions 373769,373774 via svnmerge from	14 years ago
sched.c	Merged revisions 369005 via svnmerge from	14 years ago
security_events.c	Merged revisions 376470 via svnmerge from	13 years ago
sha1.c	Update SHA1 code to RFC 6234	15 years ago
slinfactory.c	Merged revisions 369005 via svnmerge from	14 years ago
srv.c	Merged revisions 369005 via svnmerge from	14 years ago
ssl.c	Merged revisions 373059,373062 via svnmerge from	14 years ago
strcompat.c	Merged revisions 370643 via svnmerge from	14 years ago
strings.c	Merged revisions 369005 via svnmerge from	14 years ago
stun.c	Multiple revisions 377838,377842,377848,377882,377923,377947,377992,378037,378089,378093,378120,378218,378286,378320	13 years ago
syslog.c	Merged revisions 369005 via svnmerge from	14 years ago
taskprocessor.c	Multiple revisions 377838,377842,377848,377882,377923,377947,377992,378037,378089,378093,378120,378218,378286,378320	13 years ago
tcptls.c	Merged revisions 375147 via svnmerge from	13 years ago
tdd.c	Merged revisions 369005 via svnmerge from	14 years ago
term.c	Merged revisions 369005 via svnmerge from	14 years ago
test.c	Merged revisions 369005 via svnmerge from	14 years ago
threadstorage.c	Merged revisions 370643 via svnmerge from	14 years ago
timing.c	Multiple revisions 377838,377842,377848,377882,377923,377947,377992,378037,378089,378093,378120,378218,378286,378320	13 years ago
translate.c	Merged revisions 369005 via svnmerge from	14 years ago
udptl.c	Multiple revisions 377838,377842,377848,377882,377923,377947,377992,378037,378089,378093,378120,378218,378286,378320	13 years ago
ulaw.c	Merged revisions 369005 via svnmerge from	14 years ago
utils.c	Merged revisions 376431 via svnmerge from	13 years ago
xml.c	Merged revisions 369005 via svnmerge from	14 years ago
xmldoc.c	Multiple revisions 377136,377166,377212,377227,377241,377258,377261,377354,377382,377399,377432,377504,377510,377558,377592,377624,377656,377705,377709,377741,377772	13 years ago