Posts Tagged sip

Asterisk 1.8.0-Beta3 Now Available

Asterisk The Open Source PBX & Telephony Platform

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced the release of Asterisk 1.8.0-beta3.
This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

All interested users of Asterisk are encouraged to participate in the 1.8 testing process. Please report any issues found to the issue tracker, http://issues.asterisk.org/. It is also very useful to see successful test reports. Please post those to the asterisk-dev mailing list.

Asterisk 1.8 is the next major release series of Asterisk. It will be a Long Term Support (LTS) release, similar to Asterisk 1.4. For more information about support time lines for Asterisk releases, see the Asterisk versions page.

http://www.asterisk.org/asterisk-versions

This release contains fixes since the last beta release as reported by the community. A sampling of the changes in this release include:

  • Fix a regression where HTTP would always be enabled regardless of setting.
    (Closes issue #17708. Reported, patched by pabelanger)
  • ACL errors displayed on screen when using dynamic_exclude_static in sip.conf
    (Closes issue #17717. Reported by Dennis DeDonatis. Patched by mmichelson)
  • Support “channels” in addition to “channel” in chan_dahdi.conf.
    (https://reviewboard.asterisk.org/r/804)
  • Fix parsing error in sip_sipredirect(). The code was written in a way that did a bad job of parsing the port out of a URI. Specifically, it would do badly when dealing with an IPv6 address.
    (Closes issue #17661. Reported by oej. Patched by mmichelson)
  • Fix inband DTMF detection on outgoing ISDN calls.
    (Patched by russellb and rmudgett)
  • Fixes issue with translator frame not getting freed. This issue prevented g729 licenses from being freed up.
    (Closes issue #17630. Reported by manvirr. Patched by dvossel)
  • Fixed IPv6-related SIP parsing bugs and updated documention.
    (Reported by oej. Patched by sperreault)
  • Add new, self-contained feature FIELDNUM(). Returns a 1-based index into a list of a specified item. Matches up with FIELDQTY() and CUT().
    (Closes #17713. Reported, patched by gareth. Tested by tilghman)

Asterisk 1.8 contains many new features over previous releases of Asterisk.
A short list of included features includes:

  • Secure RTP
  • IPv6 Support in the SIP Channel
  • Connected Party Identification Support
  • Calendaring Integration
  • A new call logging system, Channel Event Logging (CEL)
  • Distributed Device State using Jabber/XMPP PubSub
  • Call Completion Supplementary Services support
  • Advice of Charge support
  • Much, much more!

A full list of new features can be found in the CHANGES file.

http://svn.digium.com/view/asterisk/branches/1.8/CHANGES?view=checkout

For a full list of changes in the current release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.8.0-beta3

Thank you for your continued support of Asterisk!

, , , , , , , , ,

No Comments

Asterisk 1.4.33-Rc1 And Asterisk 1.6.2.9-Rc1 Now Available

Asterisk The Open Source PBX & Telephony Platform

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced release candidates of Asterisk for versions 1.4.33 and 1.6.2.9. These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

These release candidates address issues that were reported by the community and resolved since the last round of bug fix releases.

The following is a sampling of issues resolved in these release candidates:

  • Allow compilation on Mac OS X 10.4 (Tiger)
    (Closes issue #17297. Reported by jcovert. Patched by tilghman)
  • Fix issue where IMAP backend would count messages twice in INBOX for MWI.
    (Closes issue #17135. Reported, patched by edhorton. Patched by tilghman)
  • Fix segfault on logging.
    (Closes issue #17331. Reported, tested by under. Patched by dvossel)
  • Fix crash when processing Cisco DTMF samples.
    (Closes issue #17248. Reported by falves11. Patched by dvossel)
  • Fix crash in check_rtp_timeout.
    (Closes issue #17271. Reported, patched by under. Tested by dvossel)
  • Fix transcode_via_sln option with SIP calls and improve PLC usage.
    (Patched by mmichelson. Reviewboard https://reviewboard.asterisk.org/r/622/ )

For a full list of changes in the current release candidates, please see the ChangeLogs:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.4.33-rc1
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.2.9-rc1

Issues found in any of these release candidates should be reported to the Asterisk issue tracker at https://issues.asterisk.org

Thank you for your continued support of Asterisk!

, , , , , ,

No Comments

Asterisk 1.4.32 Now Available

Asterisk The Open Source PBX & Telephony Platform

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced the release of Asterisk 1.4.32. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The release of Asterisk 1.4.32 resolves several issues reported by the community, and would have not been possible without your participation.
Thank you!

The following are a few of the issues resolved by community developers:

  • Make the mixmonitor thread process audio frames faster.
    (Closes issue #17078. Reported, tested by: geoff2010. Patched by dhubbard)
  • When StopMonitor is called, ensure that it will not be restarted by a channel event.
    (Closes issue #16590. Reported, patched by: kkm)
  • Fix up hidecallerid feature in chan_dahdi.
    (Closes issue #17143, #7321. Reported, patched by djenson99)
  • Resolve deadlocks in chan_local.
    (Closes issue #17185. Reported, tested by schmoozecom, GameGamer43)
  • Ensure channel state is not incorrectly set in the case of a very early answer.
    (Closes issue #17067. Reported, patched by tzafrir)
  • Registration fix for SIP realtime.
    (Closes issue #17266. Reported, patched by Nick_Lewis. Tested by sberney)

For a full list of changes in the current release, please see the
ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.4.32

Thank you for your continued support of Asterisk!

, , , ,

No Comments

More Fax, More Features

Aloha,

In Digium’s continuing quest to deliver you, our users of Free Fax For Asterisk, and our customers of Fax For Asterisk, with the best possible solution, we are pleased to announce the availability of version 1.2 of…(drum roll without suspense) Fax For Asterisk.

How has this version improved? Why, with new features, of course, hence the title of this blog post.

New features include:

  • DAHDI Buffer Policy Implementation -Currently requiring the trunk version of Asterisk, in addition to the 1.2 release of Fax For Asterisk, new dialplan functions to allow the setting of buffer policies to prevent fax failures on higher latency systems, e.g.:exten => 1234,Set(CHANNEL(buffers)=”12,half”)where “12″ represents a number of buffers (each buffer is 20ms), configurable between 4 and 32, and where “half” represents the policy implementation, configurable as “immediate,” “full,” or “half.”

    To use, simply set your buffer policy in your dialplan before any send/receive fax operation across a DAHDI channel.

  • SIP Fax Detection Options -At present, also requiring the trunk version of Asterisk in addition to the 1.2 release of Fax For Asterisk, new options are available related to T.38 session initiation. Older releases of Fax For Asterisk only detect T.38 fax upon the receipt of CNG. In practice, we’ve discovered that a number of T.38 providers send T.38 invites immediately, and never send CNG to initiate a T.38 session. Thus, the faxdetect option in sip.conf can now be set to:no – To disable all fax detectioncng – To trigger fax detection based on the receipt of a CNG tone

    t38 – To trigger fax detection based on the receipt of a SIP T.38 invite, without CNG tone

    yes – To trigger fax detection based on the receipt of either a CNG tone or a SIP T.38 invite.

    These changes should improve our compatibility with the wild, wild west of T.38 implementations.

  • New CLI Commands -New Asterisk command line interface commands are available to display the settings configured in res_fax and res_fax_digium, simply run:fax show settingsto see your current settings.
  • Asterisk CLI Type Column -A “Type” column is now displayed when “fax show sessions” is run on the Asterisk CLI, informing the user whether the fax is of type “G.711″ or of type “T.38.”
  • ECM Configuration per Provider / Peer & Configuration Moved -Error correction mode may now be configured on a per provider / peer basis. This proves useful in the case that a provider does not implemented T.38 ECM properly. Digium has observed that ECM must be disabled for T.38 faxing to work properly with Gafachi.Configuration of error correction mode has moved from res_fax_digium.com into the res_fax.conf configuration file. Note that the default setting is still to enable ECM.
  • SendFax initiate T.38 re-invite -Digium observed that a number of providers or far-end systems did not send a T.38 re-invite and instead waited for the local system (Asterisk) to send it instead. The SendFax application now supports the “z” option to enable this feature. If the “z” option is set during a SendFax, then res_fax will initiate the T.38 re-invite if it is not received in 10 (ten) seconds from the far end. Digium observed that the “z” option must be used for T.38 faxing to work properly with Gafachi.
  • Send / ReceiveFax G.711 Fallback mode -A new fallback option “f” has been added to the SendFax and ReceiveFax applications. In the event that T.38 negotiation fails, enabling this option will cause Asterisk to revert to audio fax mode. Digium has observed this is required for some providers, like BroadVox, who provide T.38 for inbound faxing, but accept only audio faxing for outbound.Please note that audio faxing over the Internet is very unreliable, and Digium cannot provide support for fax failures due to poor Internet connections.
  • New Debugging utilities -In order to make debugging easier, we’ve added two new command line capture options, one for audio faxes and one for T.38 faxes.For audio capture, do “fax set g711cap on” in the Asterisk CLI and a stereo wav file will be created for each fax session. The resulting files will be saved in /var/log/asterisk/g711cap. To stop capture, do “fax set g711cap off.”For T.38 capture, do “fax set t38cap on” in the Asterisk CLI and a Wireshark compatible pcap file will be created for each fax session. The resulting files will be saved in /var/log/asterisk/t38cap. To stop capture, do “fax set t38cap off.”

Ready to upgrade? Run right over to the Fax For Asterisk Download Selector and grab the new release.

As always, we thank you for your support.

Cheers.

, , , , ,

No Comments

Asterisk Security Advisory – AST-2010-001: T.38 Remote Crash Vulnerability

Asterisk The Open Source PBX & Telephony Platform

Asterisk The Open Source PBX & Telephony Platform

Asterisk Project Security AdvisoryAST-2010-001

ProductAsterisk
SummaryT.38 Remote Crash Vulnerability
Nature of AdvisoryDenial of Service
SusceptibilityRemote unauthenticated sessions
SeverityCritical
Exploits KnownNo
Reported On12/03/09
Reported Byissues.asterisk.org users bklang and elsto
Posted On02/03/10
Last Updated OnFebruary 2, 2010
Advisory ContactDavid Vossel < dvossel AT digium DOT com >
CVE NameCVE-2010-0441

Read the rest of this entry »

, , , , , ,

No Comments

Asterisk 1.6.0.22, Asterisk 1.6.1.14, Asterisk 1.6.2.2 Released

Asterisk The Open Source PBX & Telephony Platform

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced security releases for Asterisk as the following versions:

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The releases of Asterisk 1.6.0.22, 1.6.1.14, and 1.6.2.2 include the fix described in security advisory AST-2010-001.

The issue is that an attacker attempting to negotiate T.38 over SIP can remotely crash Asterisk by modifying the FaxMaxDatagram field of the SDP to contain either a negative or exceptionally large value. The same crash will occur when the FaxMaxDatagram field is omitted from the SDP, as well.

For more information about the details of this vulnerability, please read the security advisory AST-2010-001, which was released at the same time as this announcement.

For a full list of changes in the current releases, please see the ChangeLog:

Security advisory AST-2010-001 is available at:
http://asterisk.net.ru/en/2010/02/03/asterisk-security-advisory-ast-2010-001-t-38-remote-crash-vulnerability/

Thank you for your continued support of Asterisk!

, , , , , , , , , , ,

No Comments

Asterisk 1.6.0.21 Now Available

Asterisk The Open Source PBX & Telephony Platform

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced the release of Asterisk 1.6.0.21.
This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The release of Asterisk 1.6.0.21 resolved several issues reported by the community, and would have not been possible without your participation. Thank you!

  • Fix to Monitor which previously assumed the file to write to did not contain pathing.
    (Closes issue #16377#16376. Reported by bcnit. Patched by dant.
  • If EXEC only gets a single argument, don’t crash when the second is used.
    (Closes issue #16504. Reported by bklang. Patched by tilghman.)
  • Avoid a crash with large numbers of MeetMe conferences.
    (Closes issue #16509. Reported by Kashif Raza. Tested, Patched by seanbright.)
  • Try a test compile to see if PTHREAD_ONCE_INIT requires extra braces (for Solaris 10).
    (Patched by seanbright.)
  • Allow “REMAINDER” to function properly in expressions.
    (Closes issue #16427. Reported, Patched by wdoekes.)
  • Shut down the SIP session timers more gracefully, in order to prevent a possible crash.
    (Reported, Tested by corruptor. Patched by tilghman.)
  • Fix channel name comparison for Bridge() application.
    (Closes issue #16528. Reported, Patched by telecos82.)

A summary of changes in this release can be found in the release summary:
http://downloads.asterisk.org/pub/telephony/asterisk/asterisk-1.6.0.21-summary.txt

For a full list of changes in this releases, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.0.21

Thank you for your continued support of Asterisk!
Read the rest of this entry »

, , , , , , ,

No Comments

Asterisk 1.4.29 Now Available

Asterisk The Open Source PBX & Telephony Platform

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team has announced the release of Asterisk 1.4.29.
This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The release of Asterisk 1.4.29 resolved several issues reported by the community, and would have not been possible without your participation. Thank you!

  • Fix to Monitor which previously assumed the file to write to did not contain pathing.
    (Closes issue #16377#16376. Reported by bcnit. Patched by dant.
  • Propertly set T.38 attributes and don’t return before T.38 ports are configured when T.38 is found but no audio stream is found.
    (Closes issue #16318. Reported by bird_of_Luck. Tested by vrban, mihaill. Patched by vrban, mnicholson.)
  • Avoid crashes with large numbers of MeetMe conferences.
    (Closes issue #16509. Reported by Kashif Raza. Tested, Patched by seanbright.)
  • Change in ‘sip show channels’ display format allowing more digits for CID.
    (Closes issue #16459. Reported, Patched by Rzadzins.
  • Revise documentation on disposition values to the actual values used.
    (Closes issue #16289. Reported by wdoekes.)

A summary of changes in this release can be found in the release summary:
http://downloads.asterisk.org/pub/telephony/asterisk/asterisk-1.4.29-summary.txt

For a full list of changes in this releases, please see the ChangeLog:
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.4.29

Thank you for your continued support of Asterisk!
Read the rest of this entry »

, , , , , , , ,

No Comments

Asterisk Security Advisory – AST-2009-005: Remote Crash Vulnerability in SIP channel driver

Asterisk The Open Source PBX & Telephony Platform

Asterisk The Open Source PBX & Telephony Platform

On certain implementations of libc, the scanf family of functions uses an unbounded amount of stack memory to repeatedly allocate string buffers prior to conversion to the target type. Coupled with Asterisk‘s allocation of thread stack sizes that are smaller than the default, an attacker may exhaust stack memory in the SIP stack network thread by presenting excessively long numeric strings in various fields.
Note that while this potential vulnerability has existed in Asterisk for a very long time, it is only potentially exploitable in 1.6.1 and above, since those versions are the first that have allowed SIP packets to exceed 1500 bytes total, which does not permit strings that are large enough to crash Asterisk. (The number strings presented to us by the security researcher were approximately 32,000 bytes long.)

Additionally note that while this can crash Asterisk, execution of arbitrary code is not possible with this vector.

Upgrade Asterisk to one of the releases listed below.

Asterisk Project Security AdvisoryAST-2009-005

Product

Asterisk

Summary

Remote Crash Vulnerability in SIP channel driver

Nature of Advisory

Denial of Service

Susceptibility

Remote Unauthenticated Sessions

Severity

Critical in 1.6.1; minor in lesser versions

Exploits Known

No

Reported On

July 28, 2009

Reported By

Nick Baggott < nbaggott AT mudynamics DOT com >

Posted On

August 10, 2009

Last Updated On

August 10, 2009

Advisory Contact

Tilghman Lesher < tlesher AT digium DOT com >

CVE Name

CVE-2009-2726

Read the rest of this entry »

, , , , ,

No Comments

Asterisk 1.2.34, Asterisk 1.4.26.1, Asterisk 1.6.0.13, and Asterisk 1.6.1.4 released

Asterisk The Open Source PBX & Telephony Platform

Asterisk The Open Source PBX & Telephony Platform

The Asterisk Development Team is pleased to announce the releases of 1.2.34, 1.4.26.1, 1.6.0.13, and 1.6.1.4. These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/

The release of 1.6.1.4 fixes a remote crash security vulnerability in the SIP stack. Although this crash was not demonstrated in any other version, the details of the vulnerability suggested the possibility that related attacks might be possible in the future. We therefore opted to release new versions of all current releases with these fixes applied. For more information about the details of this vulnerability, please read the security advisory AST-2009-005, which was released at the same time as this announcement.

In addition, Asterisk users may notice that we skipped the version numbers 1.6.0.11 and 1.6.1.3. This was intentional, in an effort to avoid confusion about what a particular release contains. Both of those version numbers had candidates for releases made, so backtracking on those changes in a release with the same version number might be confusing. Those release candidates will be reissued with additional bugfixes, as 1.6.0.14-rc1 and 1.6.1.5-rc1, respectively.

For a full list of changes in the current releases, please see the ChangeLogs:
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-1.2.34
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.4.26.1
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.0.13
http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-1.6.1.4

Thank you for your continued support of Asterisk!

Read the rest of this entry »

, , , , , , , , ,

No Comments