Asterisk
  1. Asterisk
  2. ASTERISK-27807

iostreams: Potential DoS when client connection closed prematurely

    Details

    • Type: Security Security
    • Status: Closed
    • Severity: Blocker Blocker
    • Resolution: Fixed
    • Affects Version/s: 15.3.0
    • Target Release Version/s: 15.4.1, 15.5.0, 16.0.0
    • Component/s: Core/HTTP
    • Labels:

      Description

      Before Asterisk sends an HTTP response (at least in the case of errors), it attempts to read & discard the content of the request. If the client lies about the Content-Length, or the connection is closed from the client side before "Content-Length" bytes are sent, the request handling thread will busy loop. I tracked this down to the SSL handling in main/iostream.c.

      I've attached a file that will help in reproducing this problem. You can test it against a running Asterisk 15 with the following:

      cat reproduce.txt | openssl s_client -connect whatever.your.hostname.is.com:8089 -ign_eof
      

      Once connected, just hit Ctrl-C and the Asterisk thread will start using 100% CPU.

      1. AST-2018-007.pdf
        35 kB
        Kevin Harwell
      2. reproduce.txt
        0.1 kB
        Sean Bright

        Issue Links

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

          Hide
          Asterisk Team added a comment -

          Thanks for creating a report! The issue has entered the triage process. That means the issue will wait in this status until a Bug Marshal has an opportunity to review the issue. Once the issue has been reviewed you will receive comments regarding the next steps towards resolution.

          A good first step is for you to review the Asterisk Issue Guidelines if you haven't already. The guidelines detail what is expected from an Asterisk issue report.

          Then, if you are submitting a patch, please review the Patch Contribution Process.

          Show
          Asterisk Team added a comment - Thanks for creating a report! The issue has entered the triage process. That means the issue will wait in this status until a Bug Marshal has an opportunity to review the issue. Once the issue has been reviewed you will receive comments regarding the next steps towards resolution. A good first step is for you to review the Asterisk Issue Guidelines if you haven't already. The guidelines detail what is expected from an Asterisk issue report. Then, if you are submitting a patch, please review the Patch Contribution Process .
          Hide
          Asterisk Team added a comment -

          This issue has been automatically restricted and set to a blocker due to being a security type issue. If this is not a security vulnerability issue it will be moved to the appropriate issue type when triaged.

          Show
          Asterisk Team added a comment - This issue has been automatically restricted and set to a blocker due to being a security type issue. If this is not a security vulnerability issue it will be moved to the appropriate issue type when triaged.
          Hide
          Sean Bright added a comment - - edited

          I was unable to reproduce on Asterisk 13, so this appears to be iostreams only, and only when TLS is being used.

          Show
          Sean Bright added a comment - - edited I was unable to reproduce on Asterisk 13, so this appears to be iostreams only, and only when TLS is being used.
          Hide
          Friendly Automation added a comment -

          Change 9152 merged by Kevin Harwell:
          AST-2018-007: iostreams potential DoS when client connection closed prematurely

          https://gerrit.asterisk.org/9152

          Show
          Friendly Automation added a comment - Change 9152 merged by Kevin Harwell: AST-2018-007: iostreams potential DoS when client connection closed prematurely https://gerrit.asterisk.org/9152
          Hide
          Friendly Automation added a comment -

          Change 9169 merged by Kevin Harwell:
          AST-2018-007: iostreams potential DoS when client connection closed prematurely

          https://gerrit.asterisk.org/9169

          Show
          Friendly Automation added a comment - Change 9169 merged by Kevin Harwell: AST-2018-007: iostreams potential DoS when client connection closed prematurely https://gerrit.asterisk.org/9169
          Hide
          Friendly Automation added a comment -

          Change 9155 merged by Kevin Harwell:
          AST-2018-007: iostreams potential DoS when client connection closed prematurely

          https://gerrit.asterisk.org/9155

          Show
          Friendly Automation added a comment - Change 9155 merged by Kevin Harwell: AST-2018-007: iostreams potential DoS when client connection closed prematurely https://gerrit.asterisk.org/9155
          Hide
          Friendly Automation added a comment -

          Change 9171 merged by Kevin Harwell:
          AST-2018-007: iostreams potential DoS when client connection closed prematurely

          https://gerrit.asterisk.org/9171

          Show
          Friendly Automation added a comment - Change 9171 merged by Kevin Harwell: AST-2018-007: iostreams potential DoS when client connection closed prematurely https://gerrit.asterisk.org/9171

            People

            • Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: