Asterisk Project Security Advisory - On September 8, the Asterisk development team released the AST-2016-007 security advisory. The security advisory involved an RTP resource exhaustion that could be targeted due to a flaw in the "allowoverlap" option of chan_sip. Due to new information presented to the Asterisk team by Walter Doekes, they have made updates to the advisory.
570e74e1a02b9da9c957b15a54db607f1a0d2d9692d3bdfc29f57249f8d22599
On September 8, the Asterisk development team released the AST-2016-007
security advisory. The security advisory involved an RTP resource
exhaustion that could be targeted due to a flaw in the "allowoverlap"
option of chan_sip. Due to new information presented to us by Walter
Doekes, we have made the following updates to the advisory.
In the "Description" section, the following text has been added:
UPDATE (20 October, 2016):
It has been brought to our attention by Walter Doekes that
this same leak can be exploited without the use of the
overlap dialing feature. Sending SIP requests in a specific
sequence outside the norm could also cause the leak of RTP
resources. By sending an in-dialog INVITE after receiving a
404 response (but before sending an ACK), an attacker could
cause the same leak to occur."
In the "Resolution" section, the following text has been added:
UPDATE (20 October, 2016):
Because of the updated information from Walter Doekes,
disabling the allowoverlap option is not enough to solve
this issue. Users of Asterisk MUST upgrade to one of the
fixed versions listed below.
The updated advisory can be found at
http://downloads.asterisk.org/pub/security/AST-2016-007.html
and
http://downloads.asterisk.org/pub/security/AST-2016-007.pdf