ISS finds bugs in Asterisk VOIP software

Researchers have found two flaws in the Asterisk VOIP software that could allow attackers to disrupt networks.

Users of the open-source Asterisk VOIP (voice over Internet Protocol) product are advised to upgrade their software, following the discovery of two vulnerabilities that could allow attackers to disrupt network service.

The Asterisk team released a new version of the product Saturday, which addresses the problems discovered by Internet Security Systems (ISS).

Security researchers have been paying more attention to risks in VOIP products as the technology has become more widely used. Over the past few years, ISS began taking a closer look at VOIP security and discovered a number of bugs in such products, said Alain Sergile a technical product manager with ISS.

Last year ISS disclosed a flaw in Cisco Systems's Call Manager VOIP software, he said.

With the Asterisk flaws, there are two ways attackers could disrupt network service.

The first bug is straightforward. Attackers could simply flood an Asterisk network with call requests, preventing it from handling new call telephone calls, Sergile said. Under a second scenario, attackers could use an Asterisk-based network to overwhelm a second network with traffic, by leveraging Asterisk accounts that contain no passwords.

ISS released two advisories, which can be found here.

A note on the Asterisk update can be found here.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

More about AsteriskCiscoCiscoInternet Security SystemsISS GroupSecurity Systems

Show Comments