ISS Finds Bugs in Asterisk VoIP Software

Users of the open-source Asterisk voice-over-IP (VoIP) product are advised to upgrade their software, following the discovery of two vulnerabilities that could allow attackers to disrupt network service.

The Asterisk team released a new version of the product Saturday, which addresses the problems discovered by Internet Security Systems (ISS).

Security researchers have been paying more attention to risks in VoIP products as the technology has become more widely used. Over the past few years, ISS began taking a closer look at VoIP security and discovered a number of bugs in such products, said Alain Sergile, a technical product manager with ISS.

Last year, ISS disclosed a flaw in Cisco Systems’ Call Manager VoIP software, he said.

With the Asterisk flaws, there are two ways attackers could disrupt network service.

The first bug is straightforward. Attackers could simply flood an Asterisk network with call requests, preventing it from handling new telephone calls, Sergile said. Under a second scenario, attackers could use an Asterisk-based network to overwhelm a second network with traffic, by leveraging Asterisk accounts that contain no passwords.

ISS released two advisories, which can be found here.

A note on the Asterisk update can be found here.

-Robert McMillan, IDG News Service (San Francisco Bureau)

Keep checking in at our CSO Security Feed page for updated news coverage.