Category: VoIP Vulnerabilities

The Digium / Asterisk Security Team has obviously been extremely busy ensuring that Asterisk is as secure as possible given that yesterday they released 7 security advisories, although only one of them (AST2014-16) was rated as “Critical”.  The others are rated as “Moderate” or “Minor” – but still are good reasons to upgrade to the latest versions of Asterisk.  The list of advisories is:

• AST-2014-012: Mixed IP address families in access control lists may permit unwanted traffic
• AST-2014-013: PJSIP ACLs are not loaded on startup
• AST-2014-014: High call load may result in hung channels in ConfBridge
• AST-2014-015: Remote crash vulnerability in PJSIP channel driver
• AST-2014-016: Remote crash vulnerability in PJSIP channel driver
• AST-2014-017: Permission escalation through ConfBridge actions/dialplan functions
• AST-2014-018: AMI permission escalation through DB dialplan function

The issues are all fixed in the latest versions of Asterisk:

• Asterisk Open Source 1.8.32.1, 11.14.1, 12.7.1, 13.0.1
• Certified Asterisk 1.8.28-cert3, 11.6-cert8

Kudos to the Digium/Asterisk Security Team for the work they do in keeping Asterisk secure – and also for their openness in reporting the issues publicly!

The folks over at the Digium security team today released security bulletin AST-2011-012 for a remote crash vulnerability in the SIP channel drive. For info about the attack, they state only:

A remote authenticated user can cause a crash with a malformed request due to an uninitialized variable.

An assumption from this statement would be that an UNauthenticated user could not carry out this attack… but I admit to not personally knowing the SIP channel driver of Asterisk enough to be able to stand behind this conclusion.

Regardless, updates have been released in the form of new versions 1.8.7.1 and 10.0.0-rc1.