Some vulnerabilities have been reported in Zaptel, which can be exploited by malicious, local users to cause a DoS (Denial of Service) and potentially gain escalated privileges.

The vulnerabilities are caused due to the "tor2_spanconfig()" function in kernel/tor2.c and the "torisa_spanconfig()" function in kernel/torisa.c not properly sanitising the "sync" field of the "ZT_SPANCONFIG" IOCTL. This can potentially be exploited to gain escalated privileges by sending a specially crafted "ZT_SPANCONFIG" IOCTL to a vulnerable driver.

Successful exploitation requires that the driver for the "Tormenta 2 Quad-T1 PCI" or "Tormenta ISA" card is used.

Solution
Fixed in the SVN repository.
Further details available to Secunia VIM customers

Provided and/or discovered by
Tzafrir Cohen.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Digium Bug #13954:
http://bugs.digium.com/view.php?id=13954

Debian Bug #507459:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507459

Deep Links
Links available to Secunia VIM customers