On September 8, the Asterisk development team released the AST-2016-007
security advisory. The security advisory involved an RTP resource
exhaustion that could be targeted due to a flaw in the "allowoverlap"
option of chan_sip. Due to new information presented to us by Walter
Doekes, we have made the following updates to the advisory.
In the "Description" section, the following text has been added:
UPDATE (20 October, 2016):
It has been brought to our attention by Walter Doekes that
this same leak can be exploited without the use of the
overlap dialing feature. Sending SIP requests in a specific
sequence outside the norm could also cause the leak of RTP
resources. By sending an in-dialog INVITE after receiving a
404 response (but before sending an ACK), an attacker could
cause the same leak to occur."
In the "Resolution" section, the following text has been added:
UPDATE (20 October, 2016):
Because of the updated information from Walter Doekes,
disabling the allowoverlap option is not enough to solve
this issue. Users of Asterisk MUST upgrade to one of the
fixed versions listed below.
The updated advisory can be found at
http://downloads.asterisk.org/pub/security/AST-2016-007.html
and
http://downloads.asterisk.org/pub/security/AST-2016-007.pdf
