Latest News About Asterisk » t.38

Asterisk 10.2.0-rc2 Now Available

admin — Fri, 10 Feb 2012 11:52:29 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team is pleased to announce the second release candidate of Asterisk 10.2.0. This release candidate is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The release of Asterisk 10.2.0-rc2 resolves several issues reported by the community and would have not been possible without your participation.
Thank you!

The following is a sample of the issues resolved in this release candidate:

Fix deadlocks occuring in chan_agent.Bad locking order was added to chan_agent to prevent a segfault that occurred due to a race condition. This patch addresses the bad locking order by locking
the channel and its private data in the correct order. This stops the deadlock, which occurred when doing multiple interactions with agents. (closes issue ASTERISK-19285) Reported by: Alex Villacis Lasso
Include iLBC source code for distribution with AsteriskClarification regarding the iLBC source code was provided by Google, and the appropriate licenses have been included in the codecs/ilbc folder.
(closes issue: ASTERISK-18943) Reporter: Leif Madsen
Fix crash from bridge channel hangup race condition in ConfBridgeThis patch addresses two issues in ConfBridge and the channel bridge layer:
1. It fixes a race condition wherein the bridge channel could be hung up
2. It removes the deadlock avoidance from the bridging layer and makes the bridge_pvt an ao2 ref counted object
(issue ASTERISK-18988, ASTERISK-18885, ASTERISK-19100)
Reported by: Dmitry Melekhov, Alexander Akimov
Don’t do a DNS lookup on an outbound REGISTER host if there is an outbound proxy configured.
(closes issue ASTERISK-16550) reported by: Olle Johansson
Create and initialize udptl only when a dialog negotiates for image mediaPrior to this patch, the udptl struct was allocated and initialized when a dialog was associated with a peer that supported T.38, when a new SIP channel was allocated, or when an INVITE request was received. This resulted in any dialog associated with a peer that supported T.38 having udptl support assigned to it, including the UDP ports needed for communication. This patch creates and initializes the udptl structure only when the SDP for a dialog specifies that image media is supported, or when Asterisk indicates that a dialog needs to support T.38.
(closes issue ASTERISK-16698, ASTERISK-16794)
Reported by: under, Elazar; Tested by: Stefan Schmidt
Allow only one thread at time to do Asterisk cleanup/shutdownAdd locking around the really-really-quit part of the core stop/restart part. Previously more than one thread could be called to do cleanup, causing atexit handlers to be run multiple times, in turn causing segfaults. (issue ASTERISK-18883)
Patch by: Walter Doekes
Fix outbound DTMF for inband mode in chan_ooh323This tells asterisk core to generate DTMF sounds. (Closes issue ASTERISK-19233) Reported by: Matt Behrens Patches:
chan_ooh323.c.patch uploaded by Matt Behrens (License #6346)

And much more! For a full list of changes in the current release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk 1.8.10.0-rc2 Now Available

admin — Fri, 10 Feb 2012 11:51:11 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team is pleased to announce the second release candidate of Asterisk 1.8.10.0. This release candidate is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The release of Asterisk 1.8.10.0-rc2 resolves several issues reported by the community and would have not been possible without your participation.
Thank you!

The following is a sample of the issues resolved in this release candidate:

Fix deadlocks occuring in chan_agent.Bad locking order was added to chan_agent to prevent a segfault that occurred due to a race condition. This patch addresses the bad locking order by locking the channel and its private data in the correct order. This stops the deadlock, which occurred when doing multiple interactions with agents. (closes issue ASTERISK-19285) Reported by: Alex Villacis Lasso
Include iLBC source code for distribution with AsteriskClarification regarding the iLBC source code was provided by Google, and the appropriate licenses have been included in the codecs/ilbc folder.
(closes issue: ASTERISK-18943) Reporter: Leif Madsen
Don’t do a DNS lookup on an outbound REGISTER host if there is an outbound proxy configured.
(closes issue ASTERISK-16550) reported by: Olle Johansson
Create and initialize udptl only when a dialog negotiates for image mediaPrior to this patch, the udptl struct was allocated and initialized when a dialog was associated with a peer that supported T.38, when a new SIP channel was allocated, or when an INVITE request was received. This resulted in any dialog associated with a peer that supported T.38 having udptl support assigned to it, including the UDP ports needed for communication. This patch creates and initializes the udptl structure only when the SDP for a dialog specifies that image media is supported, or when Asterisk indicates that a dialog needs to support T.38.
(closes issue ASTERISK-16698, ASTERISK-16794)
Reported by: under, Elazar; Tested by: Stefan Schmidt
Allow only one thread at time to do Asterisk cleanup/shutdownAdd locking around the really-really-quit part of the core stop/restart part. Previously more than one thread could be called to do cleanup, causing atexit handlers to be run multiple times, in turn causing segfaults. (issue ASTERISK-18883)
Patch by: Walter Doekes
Fix outbound DTMF for inband mode in chan_ooh323 This tells asterisk core to generate DTMF sounds. (Closes issue ASTERISK-19233) Reported by: Matt Behrens Patches: chan_ooh323.c.patch uploaded by Matt Behrens (License #6346)

And much more! For a full list of changes in the current release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk 1.8.9.1 Now Available

admin — Tue, 07 Feb 2012 10:26:24 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced the release of Asterisk 1.8.9.1.
This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The release of Asterisk 1.8.9.1 resolves several issues reported by the community and would have not been possible without your participation.
Thank you!

The following is a sample of the issues resolved in this release:

— Fixes deadlocks occuring in chan_agent —
(Closes issue ASTERISK-19285. Reported by: Alex Villacis Lasso)
— Ensure entering T.38 passthrough does not cause an infinite loop —
(Closes issue ASTERISK-18951. Reported-by: Kristijan Vrban)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.9.1

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk 10.1.1 Now Available

admin — Tue, 07 Feb 2012 10:24:36 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced the release of Asterisk 10.1.1. This release is available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk/

The release of Asterisk 10.1.1 resolves several issues reported by the community and would have not been possible without your participation.
Thank you!

The following is a sample of the issues resolved in this release:

— Fixes deadlocks occuring in chan_agent —
(Closes issue ASTERISK-19285. Reported by: Alex Villacis Lasso)
— Ensure entering T.38 passthrough does not cause an infinite loop —
(Closes issue ASTERISK-18951. Reported-by: Kristijan Vrban)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.1.1

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk 1.8.10.0-rc1 Now Available

admin — Wed, 01 Feb 2012 12:08:17 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team is pleased to announce the first release candidate of Asterisk 1.8.10.0. This release candidate is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The release of Asterisk 1.8.10.0-rc1 resolves several issues reported by the community and would have not been possible without your participation.
Thank you!

The following is a sample of the issues resolved in this release candidate:

Include iLBC source code for distribution with AsteriskClarification regarding the iLBC source code was provided by Google, and the appropriate licenses have been included in the codecs/ilbc folder.
(closes issue: ASTERISK-18943) Reporter: Leif Madsen
Don’t do a DNS lookup on an outbound REGISTER host if there is an outbound proxy configured.
(closes issue ASTERISK-16550) reported by: Olle Johansson
Create and initialize udptl only when a dialog negotiates for image mediaPrior to this patch, the udptl struct was allocated and initialized when a dialog was associated with a peer that supported T.38, when a new SIP channel was allocated, or when an INVITE request was received. This resulted in any dialog associated with a peer that supported T.38 having udptl support assigned to it, including the UDP ports needed for communication. This patch creates and initializes the udptl structure only when the SDP for a dialog specifies that image media is supported, or when Asterisk indicates that a dialog needs to support T.38.
(closes issue ASTERISK-16698, ASTERISK-16794)
Reported by: under, Elazar; Tested by: Stefan Schmidt
Allow only one thread at time to do Asterisk cleanup/shutdownAdd locking around the really-really-quit part of the core stop/restart part. Previously more than one thread could be called to do cleanup, causing atexit handlers to be run multiple times, in turn causing segfaults.
(issue ASTERISK-18883)
Patch by: Walter Doekes
Fix outbound DTMF for inband mode in chan_ooh323This tells asterisk core to generate DTMF sounds. (Closes issue ASTERISK-19233) Reported by: Matt Behrens Patches: chan_ooh323.c.patch uploaded by Matt Behrens (License #6346)

And much more! For a full list of changes in the current release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk 10.0.0 Is Released

admin — Thu, 15 Dec 2011 11:48:54 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team is proud to announce the release of Asterisk 10.0.0. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

Asterisk 10 is the next major release series of Asterisk. It will be a Standard support release, similar to Asterisk 1.6.2. For more information about support time lines for Asterisk releases, see the Asterisk versions page:

https://wiki.asterisk.org/wiki/display/AST/Asterisk+Versions

With the release of the Asterisk 10 branch, the preceding ’1.’ has been removed from the version number per the blog post available at

http://blogs.digium.com/2011/07/21/the-evolution-of-asterisk-or-how-we-a…

The release of Asterisk 10 would not have been possible without the support and contributions of the community.

You can find an overview of the work involved with the 10.0.0 release in the summary:

http://svn.asterisk.org/svn/asterisk/tags/10.0.0/asterisk-10.0.0-summary…

A short list of available features includes:

T.38 gateway functionality has been added to res_fax.
Protocol independent out-of-call messaging support. Text messages not associated with an active call can now be routed through the Asterisk dialplan. SIP and XMPP are supported so far.
New highly optimized and customizable ConfBridge application capable of mixing audio at sample rates ranging from 8kHz-192kHz
Addition of video_mode option in confbridge.conf to provide basic video conferencing in the ConfBridge() dialplan application.
Support for defining hints has been added to pbx_lua.
Replacement of Berkeley DB with SQLite for the Asterisk Database (AstDB).
Much, much more!

A full list of new features can be found in the CHANGES file.

http://svn.asterisk.org/svn/asterisk/branches/10/CHANGES

Also, when upgrading a system between major versions, it is imperative that you read and understand the contents of the UPGRADE.txt file, which is located at:

http://svn.asterisk.org/svn/asterisk/branches/10/UPGRADE.txt

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk 10.0.0 Beta 1 Now Available

admin — Fri, 22 Jul 2011 11:32:24 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team is pleased to announce the first beta release of Asterisk 10.0.0-beta1. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

With the release of the Asterisk 10 branch, the preceding ’1.’ has been removed from the version number per the blog post available at http://blogs.digium.com/2011/07/21/the-evolution-of-asterisk-or-how-we-a…

All interested users of Asterisk are encouraged to participate in the Asterisk 10 testing process. Please report any issues found to the issue tracker, https://issues.asterisk.org/jira. It is also very useful to see successful test reports. Please post those to the asterisk-dev mailing list.

All Asterisk users are invited to participate in the #asterisk-testing channel on IRC to work together in testing the many parts of Asterisk. Additionally users can make use of the RPM and DEB packages now being built for all Asterisk releases. More information available at https://wiki.asterisk.org/wiki/display/AST/Asterisk+Packages

A short list of included features includes:

T.38 gateway functionality has been added to res_fax.
Protocol independent out-of-call messaging support. Text messages not associated with an active call can now be routed through the Asterisk dialplan. SIP and XMPP are supported so far.
New highly optimized and customizable ConfBridge application capable of mixing audio at sample rates ranging from 8kHz-192kHz
Addition of video_mode option in confbridge.conf to provide basic video conferencing in the ConfBridge() dialplan application.
Support for defining hints has been added to pbx_lua.
Replacement of Berkeley DB with SQLite for the Asterisk Database (AstDB).
Much, much more!

A full list of new features can be found in the CHANGES file.

http://svnview.digium.com/svn/asterisk/branches/10/CHANGES

For a full list of changes in the current release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-…

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk 1.4.42 Now Available (Final Maintenance Release)

admin — Wed, 29 Jun 2011 06:45:58 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced the final maintenance release of Asterisk, version 1.4.42. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

Please note that Asterisk 1.4.42 is the final maintenance release from the 1.4 branch. Support for security related issues will continue until April 21, 2012. For more information about support of the various Asterisk branches, see https://wiki.asterisk.org/wiki/display/AST/Asterisk+Versions

The release of Asterisk 1.4.42 resolves several issues reported by the community and would have not been possible without your participation.
Thank you!

The following is a sample of the issues resolved in this release:

Resolve regression with ring groups in the Dial() application
(Closes issue ASTERISK-17874. Reported by mspuhler. Patched by elguero)
Resolve deadlock when using tab completion on the ‘meetme kick’ CLI command when an invalid (non-existent) conference room is specified.
(Closes issue ASTERISK-17771. Reported, patched by zvision)
Resolve issue where voice frames could be dropped when checking for T.38 during early media.
(Closes issue ASTERISK-17705. Reported, patched by oej)
Resolve issue where DYNAMIC_FEATURES would not activate after a recent DTMF fix.
(Closes issue ASTERISK-17914. Reported by vrban. Patched by twilson)

Additionally security announcements AST-2011-010, and AST-2011-011 have been resolved in this release.

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.4.42

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk 1.4.39.2, Asterisk 1.6.1.22, Asterisk 1.6.2.16.2 and Asterisk 1.8.2.4 Now Available

admin — Tue, 22 Feb 2011 12:02:04 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced security releases for Asterisk branches 1.4, 1.6.1, 1.6.2, and 1.8. The available security releases are released as versions 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and 1.8.2.4.

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The releases of Asterisk 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and 1.8.2.4 resolve an issue that when decoding UDPTL packets, multiple stack and heap based arrays can be made to overflow by specially crafted packets. Systems doing T.38 pass through or termination are vulnerable. The issue and resolution are described in the AST-2011-002 security advisory.

For more information about the details of this vulnerability, please read the security advisory AST-2011-002, which was released at the same time as this announcement.

For a full list of changes in the current release, please see the ChangeLog:

Security advisory AST-2011-002 is available at:

http://downloads.asterisk.org/pub/security/AST-2011-002.pdf

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk Security Advisory – AST-2011-002: Multiple array overflow and crash vulnerabilities in UDPTL code

admin — Mon, 21 Feb 2011 20:45:39 +0000

Product	Asterisk
Summary	Multiple array overflow and crash vulnerabilities in UDPTL code
Nature of Advisory	Exploitable Stack and Heap Array Overflows
Susceptibility	Remote Unauthenticated Sessions
Severity	Critical
Exploits Known	No
Reported On	January 27, 2011
Reported By	Matthew Nicholson
Posted On	February 21, 2011
Last Updated On	February 22, 2011
Advisory Contact	Matthew Nicholson
CVE Name

Description

When decoding UDPTL packets, multiple stack and heap based arrays can be made to overflow by specially crafted packets. Systems configured for T.38 pass through or termination are vulnerable.

Resolution

The UDPTL decoding routines have been modified to respect the limits of exploitable arrays.

In asterisk versions not containing the fix for this issue, disabling T.38 support will prevent this vulnerability from being exploited. T.38 support can be disabled in chan_sip by setting the t38pt_udptl option to “no” (it is off by default).

t38pt_udptl = no

The chan_ooh323 module should also be disabled by adding the following line in modles.conf.

noload => chan_ooh323

Affected Versions
Product	Release Series
Asterisk Open Source	1.4.x	All versions
Asterisk Open Source	1.6.x	All versions
Asterisk Business Edition	C.x.x	All versions
AsteriskNOW	1.5	All versions
s800i (Asterisk Appliance)	1.2.x	All versions

Corrected In
Product	Release
Asterisk Open Source	1.4.39.2, 1.6.1.22, 1.6.2.16.2, 1.8.2.4
Asterisk Business Edition	C.3.6.3

Patches
URL	Branch
http://downloads.asterisk.org/pub/security/AST-2011-002-1.4.diff	1.4
http://downloads.asterisk.org/pub/security/AST-2011-002-1.6.1.diff	1.6.1
http://downloads.asterisk.org/pub/security/AST-2011-002-1.6.2.diff	1.6.2
http://downloads.asterisk.org/pub/security/AST-2011-002-1.8.diff	1.8

Links

Asterisk Project Security Advisories are posted at http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/AST-2011-002.pdf and http://downloads.digium.com/pub/security/AST-2011-002.html

Revision History
Date	Editor	Revisions Made
02/21/11	Matthew Nicholson	Initial Release
02/22/11	Matthew Nicholson	Changed some wording

Share and Enjoy:

Asterisk 1.4.35 Now Available

admin — Wed, 11 Aug 2010 13:38:15 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced the release of Asterisk 1.4.35.
This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The release of Asterisk 1.4.35 resolves several issues reported by the community and would have not been possible without your participation.
Thank you!

The following are a few of the issues resolved by community developers:

Ensure channel placed in meetme in ringing state is properly hung up.
(Closes issue #15871. Reported, patched by Ivan)
If all members are paused, the wrong status is indicated.
(Closes issue #17576. Reported, patched by ramonpeek)
Fix logging message for stale nonce.
(Closes issue #17582. Reported, patched by kenner)
Interpret device state AST_DEVICE_UNKNOWN as extension state AST_EXTENSION_NOT_INUSE.
(Closes issue #16035. Reported by francesco_r. Patched by viniciusfontes)
Resolve T.38 negotiation regression.
(Closes issue #16705. Reported by mpiazzatnetbug. Patched by ebroad)

For a full list of changes in the current release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.4.35

Thank you for your continued support of Asterisk!

Share and Enjoy:

More Fax, More Features

admin — Wed, 21 Apr 2010 20:12:35 +0000

Aloha,

In Digium’s continuing quest to deliver you, our users of Free Fax For Asterisk, and our customers of Fax For Asterisk, with the best possible solution, we are pleased to announce the availability of version 1.2 of…(drum roll without suspense) Fax For Asterisk.

How has this version improved? Why, with new features, of course, hence the title of this blog post.

New features include:

DAHDI Buffer Policy Implementation -Currently requiring the trunk version of Asterisk, in addition to the 1.2 release of Fax For Asterisk, new dialplan functions to allow the setting of buffer policies to prevent fax failures on higher latency systems, e.g.:exten => 1234,Set(CHANNEL(buffers)=”12,half”)where “12″ represents a number of buffers (each buffer is 20ms), configurable between 4 and 32, and where “half” represents the policy implementation, configurable as “immediate,” “full,” or “half.”
To use, simply set your buffer policy in your dialplan before any send/receive fax operation across a DAHDI channel.
SIP Fax Detection Options -At present, also requiring the trunk version of Asterisk in addition to the 1.2 release of Fax For Asterisk, new options are available related to T.38 session initiation. Older releases of Fax For Asterisk only detect T.38 fax upon the receipt of CNG. In practice, we’ve discovered that a number of T.38 providers send T.38 invites immediately, and never send CNG to initiate a T.38 session. Thus, the faxdetect option in sip.conf can now be set to:no – To disable all fax detectioncng – To trigger fax detection based on the receipt of a CNG tone
t38 – To trigger fax detection based on the receipt of a SIP T.38 invite, without CNG tone

yes – To trigger fax detection based on the receipt of either a CNG tone or a SIP T.38 invite.

These changes should improve our compatibility with the wild, wild west of T.38 implementations.
New CLI Commands -New Asterisk command line interface commands are available to display the settings configured in res_fax and res_fax_digium, simply run:fax show settingsto see your current settings.
Asterisk CLI Type Column -A “Type” column is now displayed when “fax show sessions” is run on the Asterisk CLI, informing the user whether the fax is of type “G.711″ or of type “T.38.”
ECM Configuration per Provider / Peer & Configuration Moved -Error correction mode may now be configured on a per provider / peer basis. This proves useful in the case that a provider does not implemented T.38 ECM properly. Digium has observed that ECM must be disabled for T.38 faxing to work properly with Gafachi.Configuration of error correction mode has moved from res_fax_digium.com into the res_fax.conf configuration file. Note that the default setting is still to enable ECM.
SendFax initiate T.38 re-invite -Digium observed that a number of providers or far-end systems did not send a T.38 re-invite and instead waited for the local system (Asterisk) to send it instead. The SendFax application now supports the “z” option to enable this feature. If the “z” option is set during a SendFax, then res_fax will initiate the T.38 re-invite if it is not received in 10 (ten) seconds from the far end. Digium observed that the “z” option must be used for T.38 faxing to work properly with Gafachi.
Send / ReceiveFax G.711 Fallback mode -A new fallback option “f” has been added to the SendFax and ReceiveFax applications. In the event that T.38 negotiation fails, enabling this option will cause Asterisk to revert to audio fax mode. Digium has observed this is required for some providers, like BroadVox, who provide T.38 for inbound faxing, but accept only audio faxing for outbound.Please note that audio faxing over the Internet is very unreliable, and Digium cannot provide support for fax failures due to poor Internet connections.
New Debugging utilities -In order to make debugging easier, we’ve added two new command line capture options, one for audio faxes and one for T.38 faxes.For audio capture, do “fax set g711cap on” in the Asterisk CLI and a stereo wav file will be created for each fax session. The resulting files will be saved in /var/log/asterisk/g711cap. To stop capture, do “fax set g711cap off.”For T.38 capture, do “fax set t38cap on” in the Asterisk CLI and a Wireshark compatible pcap file will be created for each fax session. The resulting files will be saved in /var/log/asterisk/t38cap. To stop capture, do “fax set t38cap off.”

Ready to upgrade? Run right over to the Fax For Asterisk Download Selector and grab the new release.

As always, we thank you for your support.

Cheers.

Share and Enjoy:

Asterisk Security Advisory – AST-2010-001: T.38 Remote Crash Vulnerability

admin — Tue, 02 Feb 2010 21:40:39 +0000

Asterisk The Open Source PBX & Telephony Platform

Asterisk Project Security Advisory - AST-2010-001

Product	Asterisk
Summary	T.38 Remote Crash Vulnerability
Nature of Advisory	Denial of Service
Susceptibility	Remote unauthenticated sessions
Severity	Critical
Exploits Known	No
Reported On	12/03/09
Reported By	issues.asterisk.org users bklang and elsto
Posted On	02/03/10
Last Updated On	February 2, 2010
Advisory Contact	David Vossel < dvossel AT digium DOT com >
CVE Name	CVE-2010-0441

Description

An attacker attempting to negotiate T.38 over SIP can remotely crash Asterisk by modifying the FaxMaxDatagram field of the SDP to contain either a negative or exceptionally large value. The same crash occurs when the FaxMaxDatagram field is omitted from the SDP as well.

Resolution

Upgrade to one of the versions of Asterisk listed in the “Corrected In” section, or apply a patch specified in the “Patches” section.

Affected Versions
Product	Release Series
Asterisk Open Source	1.6.x	All versions
Asterisk Business Edition	C.3	All versions

Corrected In
Product	Release
Asterisk Open Source	1.6.0.22
Asterisk Open Source	1.6.1.14
Asterisk Open Source	1.6.2.2
	C.3.3.2

Patches
SVN URL	Branch
http://downloads.asterisk.org/pub/security/AST-2010-001-1.6.0.diff	v1.6.0
http://downloads.asterisk.org/pub/security/AST-2010-001-1.6.1.diff	v1.6.1
http://downloads.asterisk.org/pub/security/AST-2010-001-1.6.2.diff	v1.6.2

Links

https://issues.asterisk.org/view.php?id=16634

https://issues.asterisk.org/view.php?id=16724

https://issues.asterisk.org/view.php?id=16517

Asterisk Project Security Advisory are posted at http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest version will be posted at http://downloads.digium.com/pub/security/.pdf and http://downloads.digium.com/pub/security/.html

Revision History
Date	Editor	Revisions Made
02/02/10	David Vossel	Initial release

Asterisk Project Security Advisory - AST-2010-001

Share and Enjoy:

Asterisk 1.6.0.22, Asterisk 1.6.1.14, Asterisk 1.6.2.2 Released

admin — Tue, 02 Feb 2010 21:28:10 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced security releases for Asterisk as the following versions:

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The releases of Asterisk 1.6.0.22, 1.6.1.14, and 1.6.2.2 include the fix described in security advisory AST-2010-001.

The issue is that an attacker attempting to negotiate T.38 over SIP can remotely crash Asterisk by modifying the FaxMaxDatagram field of the SDP to contain either a negative or exceptionally large value. The same crash will occur when the FaxMaxDatagram field is omitted from the SDP, as well.

For more information about the details of this vulnerability, please read the security advisory AST-2010-001, which was released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLog:

Security advisory AST-2010-001 is available at:
http://asterisk.net.ru/en/2010/02/03/asterisk-security-advisory-ast-2010-001-t-38-remote-crash-vulnerability/

Thank you for your continued support of Asterisk!

Share and Enjoy:

Asterisk 1.4.29 Now Available

admin — Fri, 15 Jan 2010 14:27:23 +0000

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced the release of Asterisk 1.4.29.
This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The release of Asterisk 1.4.29 resolved several issues reported by the community, and would have not been possible without your participation. Thank you!

Fix to Monitor which previously assumed the file to write to did not contain pathing.
(Closes issue #16377, #16376. Reported by bcnit. Patched by dant.
Propertly set T.38 attributes and don’t return before T.38 ports are configured when T.38 is found but no audio stream is found.
(Closes issue #16318. Reported by bird_of_Luck. Tested by vrban, mihaill. Patched by vrban, mnicholson.)
Avoid crashes with large numbers of MeetMe conferences.
(Closes issue #16509. Reported by Kashif Raza. Tested, Patched by seanbright.)
Change in ‘sip show channels’ display format allowing more digits for CID.
(Closes issue #16459. Reported, Patched by Rzadzins.
Revise documentation on disposition values to the actual values used.
(Closes issue #16289. Reported by wdoekes.)

A summary of changes in this release can be found in the release summary:
http://downloads.asterisk.org/pub/telephony/asterisk/asterisk-1.4.29-summary.txt

For a full list of changes in this releases, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.4.29

Thank you for your continued support of Asterisk!

News on the Asterisk Official Homepage:

http://www.asterisk.org/node/49886

News in the asterisk-announce mailing list:

http://lists.digium.com/pipermail/asterisk-announce/2010-January/000220.html

News in the asterisk-users mailing list:

http://lists.digium.com/pipermail/asterisk-users/2010-January/243386.html

News in the asterisk-dev mailing list:

http://lists.digium.com/pipermail/asterisk-dev/2010-January/041584.html

Share and Enjoy: