Description
The IAX2 channel driver (chan_iax2) in Asterisk Open 1.2.x before 1.2.23, 1.4.x before 1.4.9, and Asterisk Appliance Developer Kit before 0.6.0, when configured to allow unauthenticated calls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake, which causes an ast_channel to be allocated but not released.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asterisk | 1:1.4.9~dfsg-1 | — |
References
- 24950 vdb-entry
- GLSA-200802-11 vendor-advisory
- 29051 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=185713
- 1018472 vdb-entry
- ADV-2007-2701 vdb-entry
- 20070729 ASA-2007-018: Resource exhaustion vulnerability in IAX2 channel driver mailing-list
- 2960 third-party-advisory
- http://ftp.digium.com/pub/asa/ASA-2007-018.pdf
- 38197 vdb-entry
- 26274 third-party-advisory