summaryrefslogtreecommitdiff
path: root/comms
AgeCommit message (Collapse)AuthorFilesLines
2011-12-17Add missing mk/termcap buildlink.sbd3-5/+15
Respect LDFLAGS Bump PKGREVISION
2011-12-17Add missing mk/termcap buildlink.sbd1-1/+3
Bump PKGREVISION
2011-12-12This update is to fix AST-2011-013 and AST-2011-014.jnemeth2-16/+15
Asterisk Project Security Advisory - AST-2011-013 Product Asterisk Summary Possible remote enumeration of SIP endpoints with differing NAT settings Nature of Advisory Unauthorized data disclosure Susceptibility Remote unauthenticated sessions Severity Minor Exploits Known Yes Reported On 2011-07-18 Reported By Ben Williams Posted On Last Updated On December 7, 2011 Advisory Contact Terry Wilson <twilson at digium.com> CVE Name Description It is possible to enumerate SIP usernames when the general and user/peer NAT settings differ in whether to respond to the port a request is sent from or the port listed for responses in the Via header. In 1.4 and 1.6.2, this would mean if one setting was nat=yes or nat=route and the other was either nat=no or nat=never. In 1.8 and 10, this would mean when one was nat=force_rport or nat=yes and the other was nat=no or nat=comedia. Resolution Handling NAT for SIP over UDP requires the differing behavior introduced by these options. To lessen the frequency of unintended username disclosure, the default NAT setting was changed to always respond to the port from which we received the request-the most commonly used option. Warnings were added on startup to inform administrators of the risks of having a SIP peer configured with a different setting than that of the general setting. The documentation now strongly suggests that peers are no longer configured for NAT individually, but through the global setting in the "general" context. Affected Versions Product Release Series Asterisk Open Source All All versions Corrected In As this is more of an issue with SIP over UDP in general, there is no fix supplied other than documentation on how to avoid the problem. The default NAT setting has been changed to what we believe the most commonly used setting for the respective version in Asterisk 1.4.43, 1.6.2.21, and 1.8.7.2. Links Asterisk Project Security Advisories are posted at http://www.asterisk.org/security This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2011-013.pdf and http://downloads.digium.com/pub/security/AST-2011-013.html Revision History Date Editor Revisions Made Asterisk Project Security Advisory - AST-2011-013 Copyright (c) 2011 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form. __________________________________________________________________ Asterisk Project Security Advisory - AST-2011-014 Product Asterisk Summary Remote crash possibility with SIP and the "automon" feature enabled Nature of Advisory Remote crash vulnerability in a feature that is disabled by default Susceptibility Remote unauthenticated sessions Severity Moderate Exploits Known Yes Reported On November 2, 2011 Reported By Kristijan Vrban Posted On 2011-11-03 Last Updated On December 7, 2011 Advisory Contact Terry Wilson <twilson at digium.com> CVE Name Description When the "automon" feature is enabled in features.conf, it is possible to send a sequence of SIP requests that cause Asterisk to dereference a NULL pointer and crash. Resolution Applying the referenced patches that check that the pointer is not NULL before accessing it will resolve the issue. The "automon" feature can be disabled in features.conf as a workaround. Affected Versions Product Release Series Asterisk Open Source 1.6.2.x All versions Asterisk Open Source 1.8.x All versions Corrected In Product Release Asterisk Open Source 1.6.2.21, 1.8.7.2 Patches Download URL Revision http://downloads.asterisk.org/pub/security/AST-2011-014-1.6.2.diff 1.6.2.20 http://downloads.asterisk.org/pub/security/AST-2011-014-1.8.diff 1.8.7.1 Links Asterisk Project Security Advisories are posted at http://www.asterisk.org/security This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2011-014.pdf and http://downloads.digium.com/pub/security/AST-2011-014.html Revision History Date Editor Revisions Made Asterisk Project Security Advisory - AST-2011-014 Copyright (c) 2011 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form.
2011-12-12This update fixes AST-2011-013 and AST-2011-014. It also adapts to changesjnemeth3-22/+21
in the iLBC codec files. __________________________________________________________________ Asterisk Project Security Advisory - AST-2011-013 Product Asterisk Summary Possible remote enumeration of SIP endpoints with differing NAT settings Nature of Advisory Unauthorized data disclosure Susceptibility Remote unauthenticated sessions Severity Minor Exploits Known Yes Reported On 2011-07-18 Reported By Ben Williams Posted On Last Updated On December 7, 2011 Advisory Contact Terry Wilson <twilson at digium.com> CVE Name Description It is possible to enumerate SIP usernames when the general and user/peer NAT settings differ in whether to respond to the port a request is sent from or the port listed for responses in the Via header. In 1.4 and 1.6.2, this would mean if one setting was nat=yes or nat=route and the other was either nat=no or nat=never. In 1.8 and 10, this would mean when one was nat=force_rport or nat=yes and the other was nat=no or nat=comedia. Resolution Handling NAT for SIP over UDP requires the differing behavior introduced by these options. To lessen the frequency of unintended username disclosure, the default NAT setting was changed to always respond to the port from which we received the request-the most commonly used option. Warnings were added on startup to inform administrators of the risks of having a SIP peer configured with a different setting than that of the general setting. The documentation now strongly suggests that peers are no longer configured for NAT individually, but through the global setting in the "general" context. Affected Versions Product Release Series Asterisk Open Source All All versions Corrected In As this is more of an issue with SIP over UDP in general, there is no fix supplied other than documentation on how to avoid the problem. The default NAT setting has been changed to what we believe the most commonly used setting for the respective version in Asterisk 1.4.43, 1.6.2.21, and 1.8.7.2. Links Asterisk Project Security Advisories are posted at http://www.asterisk.org/security This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2011-013.pdf and http://downloads.digium.com/pub/security/AST-2011-013.html Revision History Date Editor Revisions Made Asterisk Project Security Advisory - AST-2011-013 Copyright (c) 2011 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form. __________________________________________________________________ Asterisk Project Security Advisory - AST-2011-014 Product Asterisk Summary Remote crash possibility with SIP and the "automon" feature enabled Nature of Advisory Remote crash vulnerability in a feature that is disabled by default Susceptibility Remote unauthenticated sessions Severity Moderate Exploits Known Yes Reported On November 2, 2011 Reported By Kristijan Vrban Posted On 2011-11-03 Last Updated On December 7, 2011 Advisory Contact Terry Wilson <twilson at digium.com> CVE Name Description When the "automon" feature is enabled in features.conf, it is possible to send a sequence of SIP requests that cause Asterisk to dereference a NULL pointer and crash. Resolution Applying the referenced patches that check that the pointer is not NULL before accessing it will resolve the issue. The "automon" feature can be disabled in features.conf as a workaround. Affected Versions Product Release Series Asterisk Open Source 1.6.2.x All versions Asterisk Open Source 1.8.x All versions Corrected In Product Release Asterisk Open Source 1.6.2.21, 1.8.7.2 Patches Download URL Revision http://downloads.asterisk.org/pub/security/AST-2011-014-1.6.2.diff 1.6.2.20 http://downloads.asterisk.org/pub/security/AST-2011-014-1.8.diff 1.8.7.1 Links Asterisk Project Security Advisories are posted at http://www.asterisk.org/security This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2011-014.pdf and http://downloads.digium.com/pub/security/AST-2011-014.html Revision History Date Editor Revisions Made Asterisk Project Security Advisory - AST-2011-014 Copyright (c) 2011 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form.
2011-12-061) Add missing mk/curses buildlink.sbd3-6/+48
2) Pass BUILDLINK_CPPFLAGS and BUILDLINK_LDFLAGS to the make process. 3) Have the build variables HAVE_LIBCURSES and HAVE_CURSES needed for the linux build set the by pkgsrc. Bump PKGREVISION
2011-12-05Put <limits.h> back and fix PR#45540adam2-4/+5
2011-12-05Now that -current has sqlite3 included in base, enable it here.jnemeth2-3/+5
2011-11-30Fix previous fix.hans2-5/+6
2011-11-29Fix a warnings about assigned but unused variable, which caused thehans3-4/+36
build to fail.
2011-11-27Fix build with newer GCCjoerg4-3/+40
2011-11-25Fix various missing includes.joerg6-18/+114
2011-11-24Fix build with newer GCCjoerg6-6/+59
2011-11-20Fix build under recent versions of Mac OS X by selectin a make targettron1-3/+9
that actually exists.
2011-11-14TOOLS+=yacc, may unbreak Linux builddholland1-1/+3
2011-11-08* Remove .require_paths from PLISTtaca2-4/+3
* Bump PKGREVISION.
2011-11-05Add LICENSE.hiramatsu1-1/+2
2011-11-01Recursive bump for graphics/freetype2 buildlink addition.sbd1-1/+2
2011-11-01Recursive bump for graphics/freetype2 buildlink addition.sbd8-16/+16
2011-10-29distutils package, register egg-info.obache2-4/+7
Bump PKGREVISION.
2011-10-17Update to 1.8.7.1 -- this update fixes AST-2011-012jnemeth3-17/+19
pkgsrc change: now what sqlite3 has been imported into NetBSD, enable it Asterisk Project Security Advisory - AST-2011-012 Product Asterisk Summary Remote crash vulnerability in SIP channel driver Nature of Advisory Remote crash Susceptibility Remote authenticated sessions Severity Critical Exploits Known No Reported On October 4, 2011 Reported By Ehsan Foroughi Posted On October 17, 2011 Last Updated On October 17, 2011 Advisory Contact Terry Wilson <twilson@digium.com> CVE Name CVE-2011-4063 Description A remote authenticated user can cause a crash with a malformed request due to an unitialized variable. Resolution Ensure variables are initialized in all cases when parsing the request. Affected Versions Product Release Series Asterisk Open Source 1.8.x All versions Asterisk Open Source 10.x All versions (currently in beta) Corrected In Product Release Asterisk Open Source 1.8.7.1, 10.0.0-rc1 Patches Download URL Revision http://downloads.asterisk.org/pub/security/AST-2011-012-1.8.diff 1.8 http://downloads.asterisk.org/pub/security/AST-2011-012-10.diff 10 Links Asterisk Project Security Advisories are posted at http://www.asterisk.org/security This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2011-012.pdf and http://downloads.digium.com/pub/security/AST-2011-012.html Revision History Date Editor Revisions Made Asterisk Project Security Advisory - AST-2011-012 Copyright (c) 2011 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form.
2011-10-14Fix build with perl 5.14.1hiramatsu3-1/+593
2011-10-12Update to 1.8.7.0nb1.jnemeth3-5/+18
This update adds a "jabber" option which is enabled by default. This option pulls in iksemel which is used by the res_jabber. Doing this allows chan_jingle (jabber) and chan_gtalk to work.
2011-10-11Revert previous. This package was marked OWNER= for a reason!jnemeth1-3/+12
2011-10-11Update to 1.8.7.0 (mainly bug fixes).jnemeth10-115/+241
pkgsrc changes: - adjust for ilbc changes after it was acquired by Google - install AST.pdf IAX2-security.pdf into share/doc/asterisk 1.8.7.0: ======== The release of Asterisk 1.8.7.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! Please note that a significant numbers of changes and fixes have gone into features.c in this release (call parking, built-in transfers, call pickup, etc.). NOTE: Recently, we were notified that the mechanism included in our Asterisk source code releases to download and build support for the iLBC codec had stopped working correctly; a little investigation revealed that this occurred because of some changes on the ilbcfreeware.org website. These changes occurred as a result of Google's acquisition of GIPS, who produced (and provided licenses for) the iLBC codec. If you are a user of Asterisk and iLBC together, and you've already executed a license agreement with GIPS, we believe you can continue using iLBC with Asterisk. If you are a user of Asterisk and iLBC together, but you had not executed a license agreement with GIPS, we encourage you to research the situation and consult with your own legal representatives to determine what actions you may want to take (or avoid taking). More information is available on the Asterisk blog: http://blogs.asterisk.org/2011/09/19/ilbc-support-in-asterisk-after-googles-acquisition-of-gips/ The following is a sample of the issues resolved in this release: * Added the 'storesipcause' option to sip.conf to allow the user to disable the setting of HASH(SIP_CAUSE,) on the channel. Having chan_sip set HASH(SIP_CAUSE,) on the channel carries a significant performance penalty because of the usage of the MASTER_CHANNEL() dialplan function. We've decided to disable this feature by default in future 1.8 versions. This would be an unexpected behavior change for anyone depending on that SIP_CAUSE update in their dialplan. Please refer to the asterisk-dev mailing list more information: http://lists.digium.com/pipermail/asterisk-dev/2011-August/050626.html * Significant fixes and improvements to parking lots. (Closes issues ASTERISK-17183, ASTERISK-17870, ASTERISK-17430, ASTERISK-17452, ASTERISK-17452, ASTERISK-15792.) * Numerous issues have been reported for deadlocks that are caused by a blocking read in res_timing_timerfd on a file descriptor that will never be written to. A change to Asterisk adds some checks to make sure that the timerfd is both valid and armed before calling read(). Should fix: ASTERISK-18142, ASTERISK-18197, ASTERISK-18166 and possibly others. (In essence, this change should make res_timing_timerfd usable.) * Resolve segfault when publishing device states via XMPP and not connected. (Closes issue ASTERISK-18078.) * Refresh peer address if DNS unavailable at peer creation. (Closes issue ASTERISK-18000) * Fix the missing DAHDI channels when using the newer chan_dahdi.conf sections for channel configuration. (Closes issue ASTERISK-18496.) * Remove unnecessary libpri dependency checks in the configure script. (Closes issue ASTERISK-18535.) * Update get_ilbc_source.sh script to work again. (Closes issue ASTERISK-18412) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.7.0 Thank you for your continued support of Asterisk! 1.8.6.0: ======== The release of Asterisk 1.8.6.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you! The following is a sample of the issues resolved in this release: * Fix an issue with Music on Hold classes losing files in playlist when realtime is used. (Closes issue ASTERISK-17875.) * Resolve a potential crash in chan_sip when utilizing auth= and performing a 'sip reload' from the console. (Closes issue ASTERISK-17939.) * Address some improper sql statements in res_odbc that would cause an update to fail on realtime peers due to trying to set as "(NULL)" rather than an actual NULL. (Closes issue ASTERISK-17791.) * Resolve issue where 403 Forbidden would always be sent maximum number of times regardless to receipt of ACK. * Resolve issue where if a call to MeetMe includes both the dynamic(D) and always request PIN(P) options, MeetMe will ask for the PIN two times: once for creating the conference and once for entering the conference. * Fix New Zealand indications profile based on http://www.telepermit.co.nz/TNA102.pdf (Closes issue ASTERISK-16263.) * Segfault in shell_helper in func_shell.c (Closes issue ASTERISK-18109.) For a full list of changes in this release, please see the ChangeLog: http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.6.0 Thank you for your continued support of Asterisk!
2011-10-11Revert previous. This package is marked OWNER= for a reason!jnemeth1-3/+12
2011-10-09Fix native X build by cleaning up FONTDIR after imake. Ride previous bump.dholland1-3/+10
2011-10-09Add a monster cleanup patch, posted as a distfile, to fix rampantdholland9-421/+12
misuse of function pointer casts and mismatched function calls and arguments. Now this has some chance at running on something other than i386. PKGREVISION -> 12.
2011-10-08Remove zaptel option everywhere (zaptel-netbsd package was removed)shattered2-24/+6
2011-10-08Not MAKE_JOBS_SAFEdholland1-1/+3
2011-10-06Remove zaptel option, zaptel-netbsd was removed.wiz2-19/+4
2011-10-02Remove packages depending on the removed packages.wiz8-126/+1
2011-10-02Remove packages scheduled to be deleted according to the pkgsrc-2011Q2wiz5-34/+1
release notes.
2011-09-25Add a missing includesjoerg3-7/+13
2011-09-25Add missing includejoerg2-1/+14
2011-09-24Uses chown during install phase, so ensure that the user/group existsjoerg1-1/+3
for destdir operation
2011-09-03Let to use new C++ style headers first for CXX runtime check,obache2-18/+43
taken from upstream. Fixes PR pkg/45324.
2011-09-01Add a patch for PR/44766. The issue was that older versions of gasjnemeth2-1/+15
require you to use movd (instead of movq) when transferring data between reg32/64 and an mmx register. No PKGREVISION bump since it failed to compile on amd64 meaning there was no binary package.
2011-09-01Update to Device-XBee-API version 0.4dsainty2-6/+6
Changes: 0.4, 20110831 - jeagle Fix packet timeout bug reported by Dave S. Replace call to die() in __data_to_int with return undef, update docs to reflect this.
2011-08-28+p5-Device-XBee-APIdsainty1-1/+2
2011-08-28Import Device::XBee::API version 0.3.dsainty3-0/+32
Device::XBee::API is a module designed to encapsulate the Digi XBee API in object-oriented Perl. This module expects to communicate with an XBee module using the API firmware via a serial (or serial over USB) device.
2011-08-25Update to 9.0.302, see http://www.columbia.edu/kermit/ck90.html for morehans10-112/+114
information. Tested on NetBSD-current and OpenIndiana. Support for ssl and kerberos is now available through the options framework.
2011-08-25FILE is a opaque data type on 64bit SunOS, its true definition is nothans2-3/+23
available in any headers. Hack around this by adding the definition from the Illumos source in the relevant place. Fixes 64bit build.
2011-08-16Update to 1.58:wiz2-7/+6
1.58 Mon Mar 7 22:31:22 EST 2011 - Fixed RT #48229, an uninitialized value when registering to the network but getting no answer from the phone. 1.57 Mon Mar 7 20:53:03 EST 2011 - Fixed a bug in send_sms() that prevented it from working at all. The bug was introduced with the "assume_registered" option. - Fixed RT #57585. Thanks to Eric Kössldorfer for his patch and test case. - Added PDU<->latin1 conversion functions in Device::Gsm::Pdu - Note to self: first release from Australia!
2011-08-16Update to 1.54:wiz2-7/+6
1.54 Sun May 29 20:53:23 AEST 2011 - Removed uninitialized warning on $obj->{'CONNECTED'}. Fixes RT #68504.
2011-08-14Revision bump after updating perl5 to 5.14.1.obache7-11/+14
2011-08-07Bump PKGREVISION for perl update.jnemeth3-4/+6
2011-08-02Fix MAINTAINER e-mail address.ryoon1-2/+2
2011-08-01Changes 2.5:adam13-297/+109
* Handle device reconnected more smoothly (USB-serial dongles) * Translation updates: Danish * Several fixes (see ChangeLog) Changes 2.4: * Add -D and -b options to specify device and baud rate on the command line. * Do character conversion between local and remote side (-R option) * Added indonesian translation * Compatibility fixes for recent build environments * Remove code that handled very old systems Changes 2.3: * Fix build on Mac OS X * New version of the dial format to be little and big endian as well as 32/64 bit safe * Support more baud rates * Handle device disappearances (e.g. serial-USB device unplug) * Various build and other fixes Changes 2.2: * Vietnamese translation added * Norwegian translation added * Traditional chinese translation added * Swedish translation added * Romanian translation added * default to 8bit mode if LANG or LC_ALL are set * default baud rate set to 115200 * Various code cleanups and fixes
2011-07-21Fix a bunch of real world bugs that clang warns about. Fix up fix forjoerg4-11/+48
ctype usage to actually do the right thing, not just stop the warning. Bump revision.
2011-07-21recursive bump from gnome-vfs drop crypto dependency.obache2-4/+4
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-10 21:48:23 +0000