Technical Description

Two vulnerabilities have been identified in various Asterisk products, which could be exploited by attackers to cause a denial of service.

The first issue is caused by an error when processing multiple IAX2 "POKE" requests without an ACK packet sent in response to the "PONG" packet, which could be exploited to consume all IAX2 call numbers, creating a denial of service condition.

The second vulnerability is caused by an error in the firmware download protocol that does not initiate a handshake when processing requests, which could be exploited to exhaust all available resources via IAX2 FWDOWNL requests.

Affected Products

Asterisk Open Source versions 1.0.x
Asterisk Open Source versions 1.2.x
Asterisk Open Source versions 1.4.x
Asterisk Business Edition versions A.x.x
Asterisk Business Edition versions B.x.x.x
Asterisk Business Edition versions C.x.x.x
AsteriskNOW
Asterisk Appliance Developer Kit versions 0.x.x
Asterisk Appliance s800i versions 1.0.x

Solution

Upgrade to Asterisk Open Source version 1.2.30 or 1.4.21.2 :
ftp://ftp.digium.com/pub/telephony/asterisk

Upgrade to Asterisk Business Edition B.2.5.4, C.1.10.3 or C.2.0.3 :
http://downloads.digium.com/

Upgrade to Asterisk Appliance s800i version 1.2.0.1.

References

http://www.vupen.com/english/advisories/2008/2168
http://downloads.digium.com/pub/security/AST-2008-010.html
http://downloads.digium.com/pub/security/AST-2008-011.html

Credits

Vulnerabilities reported by Jeremy McNamara and Tilghman Lesher.

ChangeLog

2008-07-23 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.