Threat Level: green Handler on Duty: Guy Bruneau

SANS ISC: Several new Asterisk vulnerabilities were recently announced. SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Several new Asterisk vulnerabilities were recently announced.

The team has released new versions of code to address the following four vulnerabilities.
“AST-2008-002 details two buffer overflows that were discovered in RTP codec payload type handling.
All users of SIP in Asterisk 1.4 and 1.6 are affected.
AST-2008-003 details a vulnerability which allows an attacker to bypass SIP authentication and to make a call into the context specified in the general section of sip.conf.
All users of SIP in Asterisk 1.0, 1.2, 1.4, or 1.6 are affected.
AST-2008-004 details some format string vulnerabilities that were found in the code handling the Asterisk logger and the Asterisk manager interface.
All users of Asterisk 1.6 are affected. “

Exploitation of these types of vulnerabilities has been used in the past to gain access to asterisk servers to set up automated systems for vishing attacks.

Vishing is a term used for voice based phishing.

If you get a message, email or phone call that asks you to call a number you do not recognize check the bill for that service or the back of your credit card and call THAT number not the number that was included in the message.

Never give out personal information unless you have verified the data receiver.


206 Posts
ISC Handler
Mar 21st 2008

Sign Up for Free or Log In to start participating in the conversation!