[Home]

Summary:ASTERISK-26927: pjproject_bundled: Crash on pj_ssl_get_info() while ioqueue_on_read_complete().
Reporter:Alexander Traud (traud)Labels:
Date Opened:2017-04-07 08:04:37Date Closed:2017-04-07 15:56:55
Priority:CriticalRegression?
Status:Closed/CompleteComponents:Resources/res_pjsip/Bundling
Versions:13.14.1 14.3.1 GIT Frequency of
Occurrence
Occasional
Related
Issues:
Environment:Attachments:( 0) 0048-r5576-svn-backport-tls-crash.patch
Description:When the Asterisk channel driver {{res_pjsip}} offers SIP-over-TLS, sometimes, not reproducible, Asterisk crashes in {{pj_ssl_sock_get_info()}} because a NULL pointer was read. The attached patch avoids this crash.

From my point of view, this is a security issue because an outside, unauthenticated attacker might be able to tear down your Asterisk. However although explained to the PJProject team, they made the fix (and therefore the issue) public already. Consequently, it does not make any sense not to disclose it within Asterisk. Finally, I do not know hot to trigger this issue on purpose. I faced this issue three times within four months.
Comments:By: Friendly Automation (friendly-automation) 2017-04-07 15:56:56.449-0500

Change 5419 merged by zuul:
pjproject_bundled: Crash on pj_ssl_get_info() while ioqueue_on_read_complete().

[https://gerrit.asterisk.org/5419|https://gerrit.asterisk.org/5419]

By: Friendly Automation (friendly-automation) 2017-04-07 16:21:03.698-0500

Change 5420 merged by Joshua Colp:
pjproject_bundled: Crash on pj_ssl_get_info() while ioqueue_on_read_complete().

[https://gerrit.asterisk.org/5420|https://gerrit.asterisk.org/5420]

By: Friendly Automation (friendly-automation) 2017-04-07 17:34:27.829-0500

Change 5418 merged by Joshua Colp:
pjproject_bundled: Crash on pj_ssl_get_info() while ioqueue_on_read_complete().

[https://gerrit.asterisk.org/5418|https://gerrit.asterisk.org/5418]