VoIP Security, Asterisk, SIP, Brute Force Attacks, Explained By John Todd Of Digium.

VoIP Security snapvoip.blogspot.com
My thoughts when I read the article saying  “Asterisk attacks are endemic” were ????*&^ and I also knew that John Todd knew what he is doing. So I let the article pass as I was certain it was not the case.
Today Todd has posted an article explaining the misinterpretation of his thoughts and the verbalization of the same.

My comment in the article was not that “Asterisk attacks are endemic”, but that SIP-based brute force attacks are endemic.  Every SIP system that is open to the “public” Internet is seeing large numbers of brute-force attacks.  Sites that have weak username and weak password control will be compromised – this is little different than email accounts being taken over by password-guessing systems and used for sending floods of email.  The significant difference is that when someone takes over a SIP platform to make outbound calls, there is usually a direct monetary cost, which gets people’s attention very quickly.

We all know that Asterisk is used world over and is the favorite SIP based telephony platform is likely to attract people who are interested in hacking or attacking the system. But we also have seen security measures taken by Asterisk as well. Just like the one released day before yesterday, AST-2009-07, where the advisory and the fix was released simultaneously.
But what Todd wrote makes sense and as Asterisk, Broadsoft, Cisco, Kamailio, OpenSER, FreeSwitch, Avaya are all vulnerable to brute force attacks and every bit of  information will help. Whether it is news worthy or not.
Asterisk and SIP Security Redux

Asterisk Project Security Advisory - AST-2009-003

http://snapvoip.blogspot.com/

Asterisk Project Security Advisory - AST-2009-003

Product	Asterisk
Summary	SIP responses expose valid usernames
Nature of Advisory	Information leak
Susceptibility	Remote Unauthenticated Sessions
Severity	Minor
Exploits Known	No
Reported On	February 23, 2009
Reported By	Gentoo Linux Project: Kerin Millar ( kerframil on irc.freenode.net ) and Fergal Glynn <>
Posted On	April 2, 2009
Last Updated On	April 2, 2009
Advisory Contact	Tilghman Lesher <>
CVE Name	CVE-2008-3903

For Description, patches, fixes and more information read AST-2009-003

Tags: AST-2009-003, Asterisk security

Asterisk Security Fix For chan_sip

http://snapvoip.blogspot.com/
Asterisk Remote Crash Vulnerability in SIP channel driver, AST-2009-002 - Remote Crash Vulnerability in SIP channel driver, has been fixed in two Asterisk upgrades that we just posted.
The bug, when configured with pedantic=yes the SIP channel driver performs extra request URI checking on an INVITE received as a result of a SIP spiral. As part of this extra checking the headers from the outgoing SIP INVITE sent and the received SIP INVITE are compared. The code incorrectly assumes that the string for each header passed in will be non-NULL in all cases. This is incorrect because if no headers are present the value passed in will be NULL.
The values passed into the code are now checked to be non-NULL before being compared.

The security advisory is available at;
http://downloads.digium.com/pub/security/AST-2009-002.html

Tags: Asterisk Remote Crash Vulnerability, Asterisk, Asterisk security

Asterisk Updates (1.4.23.2) And Release Candidate (1.6.1.0-rc2)

http://snapvoip.blogspot.com/
Asterisk.org has announced the availability of the second release candidate of Asterisk 1.6.1, tagged as version 1.6.1.0-rc2. Release candidate 1.6.1.0-rc2 for immediate download.

For a full list of changes in this release candidate, please see the ChangeLog.

What is new in Asterisk1.6.1. See the CHANGES file.

Also released at the same time is the Asterisk version 1.4.23.2.

These updates for Asterisk includes a security fix for chan_sip. Please see the associated security advisory.

Both are available for download at Digium Download.

Tags: Asterisk, Asterisk security, Asterisk 1.4.23.2, Asterisk 1.6.1, Asterisk 1.6.1.0-rc2

Asterisk Postgres Realtime Engine SQL Injection

A vulnerability has been reported in Asterisk, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed as lookup data to the Postgres Realtime Engine is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires that the module is configured and used.

The vulnerability is reported in all Asterisk 1.4.x versions before 1.4.15.

Solution:
Update to Asterisk version 1.4.15.

Use the PgsqlODBC driver instead of the vulnerable module.

Provided and/or discovered by:
The vendor credits P. Chisteas.

Original Advisory:
AST-2007-025:
http://downloads.digium.com/pub/security/AST-2007-025.html
Secunia

Tags: Secunia, Asterisk security, PgsqlODBC, Asterisk 1.4, Postgres Realtime Engine, SQL injection

Asterisk CDR (Call Detail Record) Postgres SQL Injection

A vulnerability has been reported in Asterisk and Asterisk Business Edition, which can be exploited by malicious users to conduct SQL injection attacks.

Input passed as ANI and DNIS strings to the Call Detail Record Postgres logging engine is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires valid user credentials and that the module is configured and used.

The vulnerability is reported in all Asterisk 1.0.x versions, all Asterisk 1.2.x versions before 1.2.25, all Asterisk 1.4.x versions before 1.4.15, all Asterisk Business Edition A.x.x versions, and in all Asterisk Business Edition B.x.x.x versions before B.2.3.4.

Solution:
Update to Asterisk 1.2.25, Asterisk 1.4.15, or Asterisk Business Edition B.2.3.4.

Use the PgsqlODBC driver instead of the vulnerable module.
Provided and/or discovered by:
Tilghman Lesher

Original Advisory:
AST-2007-026:
http://downloads.digium.com/pub/security/AST-2007-026.html

secunia

Tags: secunia, Asterisk security, Asterisk 1.2.25, Asterisk 1.4.15, Asterisk Business Edition B.2.3.4, CDR, SQL injection, ANI, DNIS