diff options
| author | jnemeth <jnemeth@pkgsrc.org> | 2014-12-03 01:00:23 +0000 |
|---|---|---|
| committer | jnemeth <jnemeth@pkgsrc.org> | 2014-12-03 01:00:23 +0000 |
| commit | 9a143b67f8346f688061197afeedb0e60b7992ce (patch) | |
| tree | c1a1cc3db073a8b5b0e2258c916b172e5d0cb3af /comms | |
| parent | 6976b39181607489c7f388cb80a3bd8849b3b07a (diff) | |
| download | pkgsrc-9a143b67f8346f688061197afeedb0e60b7992ce.tar.gz | |
Update to Asterisk 1.8.32.1: this is a security fix release.
The Asterisk Development Team has announced security releases for Certified
Asterisk 1.8.28 and 11.6 and Asterisk 1.8, 11, 12, and 13. The available
security releases are released as versions 1.8.28-cert3, 11.6-cert8, 1.8.32.1,
11.14.1, 12.7.1, and 13.0.1.
The release of these versions resolves the following security vulnerabilities:
* AST-2014-012: Unauthorized access in the presence of ACLs with mixed IP
address families
Many modules in Asterisk that service incoming IP traffic have ACL options
("permit" and "deny") that can be used to whitelist or blacklist address
ranges. A bug has been discovered where the address family of incoming
packets is only compared to the IP address family of the first entry in the
list of access control rules. If the source IP address for an incoming
packet is not of the same address as the first ACL entry, that packet
bypasses all ACL rules.
* AST-2014-018: Permission Escalation through DB dialplan function
The DB dialplan function when executed from an external protocol, such as AMI,
could result in a privilege escalation. Users with a lower class authorization
in AMI can access the internal Asterisk database without the required SYSTEM
class authorization.
For more information about the details of these vulnerabilities, please read
security advisories AST-2014-012, AST-2014-013, AST-2014-014, AST-2014-015,
AST-2014-016, AST-2014-017, and AST-2014-018, which were released at the same
time as this announcement.
For a full list of changes in the current releases, please see the ChangeLogs:
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.8.32.1
The security advisories are available at:
* http://downloads.asterisk.org/pub/security/AST-2014-012.pdf
* http://downloads.asterisk.org/pub/security/AST-2014-018.pdf
Thank you for your continued support of Asterisk!
Diffstat (limited to 'comms')
| -rw-r--r-- | comms/asterisk18/Makefile | 4 | ||||
| -rw-r--r-- | comms/asterisk18/distinfo | 14 |
2 files changed, 9 insertions, 9 deletions
diff --git a/comms/asterisk18/Makefile b/comms/asterisk18/Makefile index 78675b8bc0c..2335ee0e4dc 100644 --- a/comms/asterisk18/Makefile +++ b/comms/asterisk18/Makefile @@ -1,9 +1,9 @@ -# $NetBSD: Makefile,v 1.89 2014/11/19 08:30:56 jnemeth Exp $ +# $NetBSD: Makefile,v 1.90 2014/12/03 01:00:23 jnemeth Exp $ # # NOTE: when updating this package, there are two places that sound # tarballs need to be checked -DISTNAME= asterisk-1.8.32.0 +DISTNAME= asterisk-1.8.32.1 DIST_SUBDIR= ${PKGNAME_NOREV} DISTFILES= ${DEFAULT_DISTFILES} EXTRACT_ONLY= ${DISTNAME}.tar.gz diff --git a/comms/asterisk18/distinfo b/comms/asterisk18/distinfo index dede4e47145..971e115f2ed 100644 --- a/comms/asterisk18/distinfo +++ b/comms/asterisk18/distinfo @@ -1,11 +1,11 @@ -$NetBSD: distinfo,v 1.57 2014/11/19 08:30:56 jnemeth Exp $ +$NetBSD: distinfo,v 1.58 2014/12/03 01:00:23 jnemeth Exp $ -SHA1 (asterisk-1.8.32.0/asterisk-1.8.32.0.tar.gz) = 3cecd9a31d99f2a9372e062c058d84962224c7c3 -RMD160 (asterisk-1.8.32.0/asterisk-1.8.32.0.tar.gz) = ef90b650e202c3902115d6738ef468b2a53eb80f -Size (asterisk-1.8.32.0/asterisk-1.8.32.0.tar.gz) = 29639709 bytes -SHA1 (asterisk-1.8.32.0/asterisk-extra-sounds-en-gsm-1.4.15.tar.gz) = fbb94494e31fc08eee8fdf2ce7d12eb274018050 -RMD160 (asterisk-1.8.32.0/asterisk-extra-sounds-en-gsm-1.4.15.tar.gz) = 53656a3d6771602504f220ad312093e3503e1150 -Size (asterisk-1.8.32.0/asterisk-extra-sounds-en-gsm-1.4.15.tar.gz) = 4409969 bytes +SHA1 (asterisk-1.8.32.1/asterisk-1.8.32.1.tar.gz) = 0cdba970a970859a98289d2bad0a585ecc877fa2 +RMD160 (asterisk-1.8.32.1/asterisk-1.8.32.1.tar.gz) = 29401ac57b03a0d1ba4a3e7722d95e710a5033c5 +Size (asterisk-1.8.32.1/asterisk-1.8.32.1.tar.gz) = 29636238 bytes +SHA1 (asterisk-1.8.32.1/asterisk-extra-sounds-en-gsm-1.4.15.tar.gz) = fbb94494e31fc08eee8fdf2ce7d12eb274018050 +RMD160 (asterisk-1.8.32.1/asterisk-extra-sounds-en-gsm-1.4.15.tar.gz) = 53656a3d6771602504f220ad312093e3503e1150 +Size (asterisk-1.8.32.1/asterisk-extra-sounds-en-gsm-1.4.15.tar.gz) = 4409969 bytes SHA1 (patch-aa) = 832f1c043b15198e0a286094dd0cc1a251bcfed0 SHA1 (patch-af) = 19786616bb606c38f769ec85f2e4d118573659ab SHA1 (patch-ai) = e92edab5c1ff323478f41d0b0783102ed527fe39 |