Fedora Account System
Red Hat Associate
Red Hat Customer
The Asterisk development team has released new versions of Asterisk for 1.2.x, 1.4.x, 1.6.0.x and 1.6.1.x that correct an IAX2 denial of service vulnerability. The security advisory (AST-2009-006) [1] indicates that 1.6.0.15 and 1.6.1.6 correct the vulnerability. This vulnerability affects all versions of Asterisk prior to 1.2.35, 1.4.26.2, 1.6.0.15, adn 1.6.1.6. Package updates for Fedora are required; apparently this changes the IAX2 protocol as well so I'm not sure if a backport is feasible. [1] http://downloads.asterisk.org/pub/security/AST-2009-006.html
MITRE's CVE-2009-2346 record: ----------------------------- The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and C.3.x before C.3.1.1; and s800i 1.3.x before 1.3.0.3 allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many IAX2 message exchanges, a related issue to CVE-2008-3263. References: ----------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2346 http://www.securityfocus.com/archive/1/archive/1/506257/100/0/threaded http://downloads.asterisk.org/pub/security/AST-2009-006.html http://www.securityfocus.com/bid/36275 http://securitytracker.com/id?1022819 http://secunia.com/advisories/36593
asterisk-1.6.0.15-1.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
asterisk-1.6.1.6-1.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report.