-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Product: Asterisk Open Source PBX
Impact: Multiple Local and Remote Denials of Service
Version(s): All versions prior to 1.2.13
Author: Jesus Oquendo
echo @infiltrated|sed 's/^/sil/g;s/$/.net/g'


I. BACKGROUND
Asterisk is an Open Source PBX which runs on Linux, BSD, Solaris and MacOSX that provides all of
the features in a standard PBX. Asterisk does voice over IP and can interoperate with almost all
telephony equipment.

II. DESCRIPTION
A sequence of malformed (pre-defined) packets can cause different denial of services on Asterisk.
The attack is both local and remote. These denial of services can range from the Asterisk server
shutting down, channels being opened and filling up queues. Log file denials of service by filling
space with errors and ranDumb messages. Voicemail space allocation being filled, and ICMP denials
of service.

III SOLUTION
Versions 1.2.13 and greater are no longer vulnerable to the attack and users are urged to update
to 1.2.13 or better.

IV. SOURCE
http://www.infiltrated.net/asteroid/asteroidv1.tar.gz

V. POSSIBILITIES
While the initial packet creation tool was tested on Asterisk, it was not targeted towards Asterisk
but at the SIP protocol. Asterisk was used merely for Wireshark packet captures in order to re-create
newer packets. The Asteroid SIP denial of service tool could also affect other products that run the
SIP protocol including soft phones, other PBX's, etc.

VI. MENTIONS
Thanks to Kevin P. Flemming and the guys at Asterisk fixing this promptly. Dan York for getting people
to pay attention. Tim Donahue for his Perl pointers, vgersh99 (aka vlad) for nawk pointers, PHV,
Annihilannic, p5wizard, Anthony LaMantia, Tzafir Cohen, and the others on the Asterisk-Dev list.

VII. TESTBED
Tested on Solaris, FreeBSD, Linux (SuSE, CentOS, Gentoo, Debian) distributions running various versions
Asterisk.

VIII. CHECKSUMS

$ md5 asteroidv1.tar.gz 
MD5 (asteroidv1.tar.gz) = b32c56ab4004d2a75eeee109d9e8d824

$ sha1 asteroidv1.tar.gz 
SHA1 (asteroidv1.tar.gz) = 0345fc7e423bddb8d9aa5fae431c0715db70a879



=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
echo @infiltrated|sed 's/^/sil/g;s/$/.net/g'
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743

"How a man plays the game shows something of his
character - how he loses shows all" - Mr. Luckey

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (FreeBSD)

iD8DBQFFRnM0h3J3NhODp0MRAu0NAJsFLdCKJgRqtjLs35GtXxRKNYNaLgCg8xxI
zZUQr4YWe0BE8RHpvEYTyEI=
=TLzd
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/