ISS Finds Bugs in Asterisk VoIP Software

Users of the open-source Asterisk VoIP (voice over Internet Protocol) product are advised to upgrade their software, following the discovery of two vulnerabilities that could allow attackers to disrupt network service.

The Asterisk team released a new version of the product Saturday, which addresses the problems discovered by Internet Security Systems. (ISS).

Security researchers have been paying more attention to risks in VOIP products as the technology has become more widely used. Over the past few years, ISS began taking a closer look at VoIP security and discovered a number of bugs in such products, said Alain Sergile a technical product manager with ISS.

Last year ISS disclosed a flaw in Cisco Systems ’s Call Manager VoIP software, he said.

With the Asterisk flaws, there are two ways attackers could disrupt network service.

The first bug is straightforward. Attackers could simply flood an Asterisk network with call requests, preventing it from handling new call telephone calls, Sergile said. Under a second scenario, attackers could use an Asterisk-based network to overwhelm a second network with traffic, by leveraging Asterisk accounts that contain no passwords.

ISS released two advisories, which can be found here.

A note on the Asterisk update can be found here.

-Robert McMillan, IDG News Service (San Francisco Bureau)

Check out our CIO News Alerts and Tech Informer pages for more updated news coverage.