A flaw in the Asterisk IP PBX platform reported last week could result in a denial-of-service attack that would disrupt a business' VoIP or VoIP-to-PSTN gateway service.
Asterisk is an open-source IP telephony and messaging platform that runs on Linux, BSD and MacOSX servers, and can be used as a complete office phone system, or to add IP-enabled services - such as messaging or gateways - to a mixed TDM/IP phone network.
A vulnerability in IAX2 (Inter-Asterisk eXchange protocol version 2), could be used to flood an Asterisk IP PBX with bogus calls and make the phone system unavailable, according to the Internet Security Systems (ISS) X-Force Threat Analysis Service, which discovered the bug.
IAX2 is normally used by Asterisk servers to set up and manage calls.
Using a method which ISS calls "somewhat analogous to a SYN flood," an attacker, with knowledge of a valid user name on an Asterisk system, could generate enough unauthenticated call requests to overwhelm the Asterisk IP PBX, ISS says.
A remote attacker could do this from a single PC or server, the security company says. Networks that use Asterisk boxes as gateways between a TDM and VoIP network could also be attacked via this method.
ISS says a setting in the Asterisk software can limit the number of simultaneous unauthenticated call requests that the Asterisk server will try to handle and resolve. Changing this setting to the lowest number of unauthenticated calls will fix the vulnerability, ISS says.
A fixed version of the software is also available from asterisk.org, which maintains the open-source platform, as well as from Digium, a company which sells service and support for Asterisk-based phone systems.