The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and C.3.x before C.3.1.1; and s800i 1.3.x before 1.3.0.3 allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many IAX2 message exchanges, a related issue to CVE-2008-3263.

The remote host is affected by the vulnerability described in GLSA-201006-20 (Asterisk: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in Asterisk:
    Nick Baggott reported that Asterisk does not properly process     overly long ASCII strings in various packets (CVE-2009-2726).
    Noam Rathaus and Blake Cornell reported a flaw in the IAX2 protocol     implementation (CVE-2009-2346).
    amorsen reported an input     processing error in the RTP protocol implementation     (CVE-2009-4055).
    Patrik Karlsson reported an information     disclosure flaw related to the REGISTER message (CVE-2009-3727).
    A vulnerability was found in the bundled Prototype JavaScript     library, related to AJAX calls (CVE-2008-7220).
  Impact :

    A remote attacker could exploit these vulnerabilities by sending a     specially crafted package, possibly causing a Denial of Service     condition, or resulting in information disclosure.
  Workaround :

    There is no known workaround at this time.

Update to 1.6.1.6 to fix many bugs...

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.6.0.15 to fix many bugs...

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Asterisk running on the remote host appears to be using an older implementation of the IAX2 protocol that does not support call token validation.  Due to a design flaw in the protocol, a remote attacker could send a large number of messages, exhausting all available call numbers in the process.  This would result in a denial of service to legitimate users.

ID	Name	Product	Family	Severity
46809	GLSA-201006-20 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
41633	Fedora 11 : asterisk-1.6.1.6-1.fc11 (2009-9405)	Nessus	Fedora Local Security Checks	high
41632	Fedora 10 : asterisk-1.6.0.15-1.fc10 (2009-9374)	Nessus	Fedora Local Security Checks	high
40885	Asterisk IAX2 Call Number Exhaustion DoS	Nessus	Denial of Service	medium

Detections

Analytics

CVE-2009-2346

high

Tenable Plugins

high

high

high

medium