Emmanouel Kellinis has reported a vulnerability in Asterisk, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a vulnerable system.

The vulnerability is cause due to a signedness error in "format_jpeg.c". This can be exploited to cause a buffer overflow via an overly large JPEG image and may allow arbitrary code execution.

The vulnerability has been reported in version 1.2.6. Prior versions may also be affected.

Solution
Update to version 1.2.7 or later.
Further details available in Customer Area

Provided and/or discovered by
Emmanouel Kellinis

Original Advisory
http://www.cipher.org.uk/index.php?p=advisories/Asterisk_Codec_Integer_Overflow_07-04-2006.advisory

Deep Links
Links available in Customer Area