[FD] AST-2016-007: UPDATE

On September 8, the Asterisk development team released the AST-2016-007 security advisory. The security advisory involved an RTP resource exhaustion that could be targeted due to a flaw in the "allowoverlap" option of chan_sip. Due to new information presented to us by Walter Doekes, we have made the following updates to the advisory. In the "Description" section, the following text has been added: UPDATE (20 October, 2016): It has been brought to our attention by Walter Doekes that this same leak can be exploited without the use of the overlap dialing feature. Sending SIP requests in a specific sequence outside the norm could also cause the leak of RTP resources. By sending an in-dialog INVITE after receiving a 404 response (but before sending an ACK), an attacker could cause the same leak to occur." In the "Resolution" section, the following text has been added: UPDATE (20 October, 2016): Because of the updated information from Walter Doekes, disabling the allowoverlap option is not enough to solve this issue. Users of Asterisk MUST upgrade to one of the fixed versions listed below. The updated advisory can be found at http://ift.tt/2ce9nH4 and http://ift.tt/2dTguby

Source: Gmail -> IFTTT-> Blogger