search for: t38faxudpec

...----+ > |Description|Two closely related stack based buffer overflows exist in the SIP/SDP | > | |handler of Asterisk, the vulnerabilities are very similar but exist as | > | |two separate unsafe function calls. The T38FaxRateManagement and | > | |T38FaxUdpEC SDP parameters can be exploited remotely leading to | > | |arbitrary code execution without authentication. In order for these | > | |overflows to occur, t38 fax over SIP must be enabled in sip.conf. | > | |Examples of SIP INVITE packets are...

...----+ > |Description|Two closely related stack based buffer overflows exist in the SIP/SDP | > | |handler of Asterisk, the vulnerabilities are very similar but exist as | > | |two separate unsafe function calls. The T38FaxRateManagement and | > | |T38FaxUdpEC SDP parameters can be exploited remotely leading to | > | |arbitrary code execution without authentication. In order for these | > | |overflows to occur, t38 fax over SIP must be enabled in sip.conf. | > | |Examples of SIP INVITE packets are...

...vites with the following sdp (message flow PROVIDER_EQPMT -> ASTERISK): """ . v=0. o=SIP_5F9 123456 654322 IN IP4 CONN_IP_PROVIDER. s=-. c=IN IP4 CONN_IP_PROVIDER. t=0 0. m=audio 0 RTP/AVP 0. m=image 26858 udptl t38. a=T38FaxMaxBuffer:288. a=T38FaxRateManagement:transferredTCF. a=T38FaxUdpEC:t38UDPRedundancy. """ The answer coming from asterisk in this case is: """ . v=0. o=root 3484 3485 IN IP4 CONN_IP_ASTERISK. s=session. c=IN IP4 CONN_IP_ASTERISK. t=0 0. m=image 4653 udptl t38. a=T38FaxVersion:0. a=T38MaxBitRate:9600. a=T38FaxRateManagement:transferre...

Hi, folks. I'm having a heck of a time trying to get outgoing T38 faxing (I don't need inbound right now) working with FFA and Gafachi. G711 faxing works (as well as can be expected over the internet), but I want the higher reliability of T38. I'm running Asterisk 10-beta1. When I drop my callfile in to make the call, I get this: -- Attempting call on SIP/18884732963 at

...otiation fails. The SDP that the Asterisk reINVITE sends contains these lines: ---------------------- m=image 4968 udptl t38 a=T38FaxVersion:0 a=T38MaxBitRate:9600 a=T38FaxFillBitRemoval a=T38FaxTranscodingMMR a=T38FaxTranscodingJBIG a=T38FaxRateManagement:transferredTCF a=T38FaxMaxDatagram:1400 a=T38FaxUdpEC:t38UDPRedundancy ---------------------- The MaxDatagram and MaxBitRate are definitely not what they should be, and maybe other parameters are also wrong. I would like to have 400 and 14400 respectively. That's the udptl.conf: ---------------------- ; ; UDPTL Configuration (UDPTL is one of...

...2 s=sip call c=IN IP4 192.168.1.2 t=0 0 m=audio 6370 RTP/AVP 18 101 a=fmtp:18 annexb=yes a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-15 a=ptime:20 m=image 6372 udptl t38 a=T38FaxVersion:0 a=T38FaxMaxBuffer:1100 a=T38FaxMaxDatagram:612 a=T38MaxBitRate:14400 a=T38FaxRateManagement:transferredTCF a=T38FaxUdpEC:t38UDPRedundancy How can I ignore T38 and use only G729 for this call?. Thanks for your help. Damian -- -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.digium.com/pipermail/asterisk-users/attachments/20131120/74d1dc38/attachment.html>

...cessing session-level SDP a=cdsc: 1 image udptl t38... UNSUPPORTED. [Feb 2 08:38:06] DEBUG[21032]: chan_sip.c:7589 process_sdp: Processing session-level SDP a=cpar: a=T38FaxVersion:0... UNSUPPORTED. [Feb 2 08:38:06] DEBUG[21032]: chan_sip.c:7589 process_sdp: Processing session-level SDP a=cpar: a=T38FaxUdpEC:t38UDPRedundancy... UNSUPPORTED. [Feb 2 08:38:06] DEBUG[21032]: chan_sip.c:7753 process_sdp: Processing media-level (audio) SDP a=rtpmap:101 telephone-event/8000... OK. [Feb 2 08:38:06] DEBUG[21032]: chan_sip.c:7753 process_sdp: Processing media-level (audio) SDP a=fmtp:101 0-15... UNSUPPORTED. [...

...ontent-Length: 315 v=0 o=XMedius-Fax-Gateway 76811410 411 IN IP4 WWW.WWW.WWW.WWW s=Asterisk PBX 10.5.0-digiumphones c=IN IP4 WWW.WWW.WWW.WWW t=0 0 m=image 54296 udptl t38 a=T38FaxVersion:0 a=T38maxBitRate:14400 a=T38FaxRateManagement:transferredTCF a=T38FaxMaxBuffer:8192 a=T38FaxMaxDatagram:1008 a=T38FaxUdpEC:t38UDPRedundancy <-------------> --- (11 headers 12 lines) --- Sending to WWW.WWW.WWW.WWW:5060 (no NAT) == Using UDPTL CoS mark 5 Got T.38 offer in SDP in dialog 176a274d5342aac505d0125979d19f62 at ZZZ.ZZZ.ZZZ.ZZZ:5060 Capabilities: us - (ulaw), peer - audio=(nothing)/video=(nothing)/text...

...remaining then, couple lines down: WARNING[3514] chan_sip.c: Unsupported SDP media type in offer: image 16400 udptl t38 WARNING[3514] chan_sip.c: Failing due to no acceptable offer found sip_general_custom.conf contains t38pt_udptl=yes udptl.conf contains: [general] udptlstart=4000 udptlend=4999 T38FaxUdpEC = t38UDPRedundancy Asterisk version is 1.8.5.0 When I restart asterisk, everything is working good. Then, after some time, fax stop working. Do you have any idea what it could be? Thanks in advance.

...e issued narrowed down to the SIP messaging between the DMG and Asterisk. The DMG invite sends to asterisk: m=audio 49016 RTP/AVP 0 101 [notice the m=audio] a=rtpmap:0 PCMU/8000/1 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-15 m=image 0 udptl t38 a=T38FaxRateManagement:transferredTCF a=T38FaxUdpEC:t38UDPRedundancy And Asterisk responds with the 200 OK: m=image 29475 udptl t38 [notice the m=image] a=T38FaxVersion:0 a=T38FaxFillBitRemoval:0 a=T38FaxTranscodingMMR:0 a=T38FaxTranscodingJBIG:0 a=T38FaxRateManagement:transferredTCF a=T38FaxMaxBuffer:400 a=T38FaxMaxDatagram:400 a...

...active time (t): 0 0 Media Description, name and address (m): image 4573 udptl t38 Media Attribute (a): T38FaxVersion:0 Media Attribute (a): T38MaxBitRate:14400 Media Attribute (a): T38FaxRateManagement:transferredTCF Media Attribute (a): T38FaxMaxDatagram:397 Media Attribute (a): T38FaxUdpEC:t38UDPRedundancy This reinvite is received by asterisk via telekom: Session Description Protocol Version (v): 0 Owner/Creator, Session Id (o): - 1811299599 2925027276 IN IP4 0.0.0.0 Session Name (s): - Time Description, active time (t): 0 0 Media Description, name and address (m):...

...t_tcp=no ignoresdpversion=yes disallow=all allow=alaw allow=ulaw externip=82.200.7.184 localnet=192.168.0.0/255.255.0.0 [mtt] type=peer host=80.75.130.136 fromuser=74957777777 disallow=all allow=alaw,ulaw directmedia=no canreinvite=no nat=yes == udptl.conf: [general] udptlstart=4000 udptlend=4999 T38FaxUdpEC=t38UDPRedundancy T38FaxMaxDatagram=200 udptlfecentries = 3 udptlfecspan = 3 use_even_ports = no == spa112 SIP settings screenshot: http://tinypic.com/view.php?pic=2z8dic6&s=5 == debug log: https://gist.github.com/anonymous/5685307 Please, help me!

...Type: application/sdp Content-Length: 293 v=0 o=root 2048302926 2048302927 IN IP4 xx.xx.xx.xx s=Asterisk PBX 1.6.2.7-rc3 c=IN IP4 xx.xx.xx.xx t=0 0 m=image 4575 udptl t38 a=T38FaxVersion:0 a=T38MaxBitRate:14400 a=T38FaxFillBitRemoval a=T38FaxRateManagement:transferredTCF a=T38FaxMaxDatagram:1400 a=T38FaxUdpEC:t38UDPFEC SIP/2.0 400 Bad Request ... CSeq: 102 INVITE Error-Info: <sip:+number at xx.xx.xx.xx>;cause="[line 023] SIP syntax error" Content-Length: 0 WARNING[32389] app_fax.c: Transmission error

...ct: <sip:3250890229 at 193.110.9.17;user=phone> Max-Forwards: 10 User-Agent: MERA MSIP v.1.0.2 Content-Type: application/sdp Content-Length: 183 v=0 o=- 1272610573 1272610573 IN IP4 193.110.9.17 s=- c=IN IP4 193.110.9.17 t=0 0 m=image 25296 udptl t38 a=T38FaxRateManagement:transferredTCF a=T38FaxUdpEC:t38UDPRedundancy Asterisk reply with TRYING and then launches sendFax() and then I get error. Executing [start at fax-out:14] SendFAX("SIP/TG-out-00000000", "/var/www/izzifax/faxes/send/2010/04/30/127261056589/fax.tif") in new stack [Apr 30 09:56:16] VERBOSE[1158] res_fax.c...

...sk means, if I directly between the ATA works perfectly, is a step to the ATA ReceiveFAX of Asterisk works perfect, but if I try to pass between two Branches using the same ATA does not work ever. rtp.conf: [general] rtpstart=17000 rtpend=33000 udptl.conf: [general] udptlstart=4000 udptlend=4999 T38FaxUdpEC = t38UDPRedundancy T38FaxMaxDatagram = 400 udptlfecentries = 3 udptlfecspan = 3 sip.conf: t38pt_udptl = yes t38pt_rtp=no t38pt_tcp=no I did a tcpdump and when after listening to the signal for a fax transmission, the network traffic for RTP, and only the end of the connection timeout in the show...

...;sip:64A510CA-5942027B00065C24-6F93C700 at 195.185.37.60;transport=udp> v=0 o=- 1935061780 1935061784 IN IP4 195.185.37.60 s=- c=IN IP4 195.185.37.60 t=0 0 m=image 33818 UDPTL t38 a=sendrecv a=T38FaxVersion:0 a=T38MaxBitRate:14400 a=T38FaxRateManagement:transferredTCF a=T38FaxMaxDatagram:1393 a=T38FaxUdpEC:t38UDPRedundancy [2017-06-15 07:43:57] DEBUG[11705]: res_pjsip/pjsip_distributor.c:379 distributor: Searching for serializer on dialog dlg0x7f5f18034698 for Request msg INVITE/cseq=10 (rdata0x7f5f1801a758) [2017-06-15 07:43:57] DEBUG[11705]: res_pjsip/pjsip_distributor.c:385 distributor: Found ser...

On Mon, Jun 5, 2017, at 04:26 PM, Michael Maier wrote: > On 06/05/2017 at 06:29 PM, Joshua Colp wrote: > > On Mon, Jun 5, 2017, at 01:22 PM, Michael Maier wrote: > >> > >> Do you have any idea where to start to look at? Adding additional output > >> in the source code? Which functions could be interesting? I may add own > >> debug code to see why things

On Fri, Jun 16, 2017, at 10:49 AM, Michael Maier wrote: <snip> > > t38modem and asterisk are using > > m=image 35622 udptl t38 > ^^^^^ > > Provider uses > > m=image 35622 UDPTL t38 > ^^^^^ > > Could this be a problem? If I'm sending internal only, it's always > lowercase. Looking at the tests we have we

On 06/14/2017 at 05:53 PM Joshua Colp wrote: > On Wed, Jun 14, 2017, at 12:47 PM, Michael Maier wrote: > > <snip> > >> >> I added this patch to see, if really all packages are are freed after >> they have been processed: >> >> --- b/res/res_pjsip/pjsip_distributor.c 2017-05-30 19:44:16.000000000 >> +0200 >> +++

Hi All I have been looking around and haven not been able to find a working example I have a fresh/new install of Asterisk 1.6.2.0 with dahdi 2.2.1 and libpri 1.4.10.2 I use a sangoma A200 card so I am using wanpipe 3.4.7 If I use zaptel which I read I need for app_rxfax then asterisk crashes with segfaults on startup asterisk[2624]: segfault at 30353466 ip b7eb538b sp bffda26c error 4 in