CVS commit: pkgsrc/comms/asterisk16

["John Nemeth" <jnemeth%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   jnemeth
Date:           Fri Jan 21 05:13:12 UTC 2011

Modified Files:
        pkgsrc/comms/asterisk16: Makefile distinfo

Log Message:
Update to 1.6.2.16.1

This is to fix AST-2011-001: Stack buffer overflow in SIP channel driver

               Asterisk Project Security Advisory - AST-2011-001

         Product        Asterisk
         Summary        Stack buffer overflow in SIP channel driver
    Nature of Advisory  Exploitable Stack Buffer Overflow
      Susceptibility    Remote Authenticated Sessions
         Severity       Moderate
      Exploits Known    No
       Reported On      January 11, 2011
       Reported By      Matthew Nicholson
        Posted On       January 18, 2011
     Last Updated On    January 18, 2011
     Advisory Contact   Matthew Nicholson <mnicholson at digium.com>
         CVE Name

   Description When forming an outgoing SIP request while in pedantic mode, a
               stack buffer can be made to overflow if supplied with
               carefully crafted caller ID information. This vulnerability
               also affects the URIENCODE dialplan function and in some
               versions of asterisk, the AGI dialplan application as well.
               The ast_uri_encode function does not properly respect the size
               of its output buffer and can write past the end of it when
               encoding URIs.

For full details, see:

http://downloads.digium.com/pub/security/AST-2011-001.html


To generate a diff of this commit:
cvs rdiff -u -r1.28 -r1.29 pkgsrc/comms/asterisk16/Makefile
cvs rdiff -u -r1.19 -r1.20 pkgsrc/comms/asterisk16/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.