|asteriskteam at digium...
|Posted: Wed Jan 02, 2008 4:39 pm Post subject: [asterisk-users] Asterisk 1.4.17 Released
|The Asterisk.org development team has released Asterisk version 1.4.17. This
release contains a fix for a SIP security issue, as well as a number of other
The security issue is documented in the published security advisory,
AST-2008-001. The vulnerability allows an attacker to cause a crash in the SIP
channel driver with a properly crafted transfer. This issue requires an
authenticated session that allows transfers to be exploited. If unauthenticated
calls with transfer capability are allowed, then this issue could be exploited
with an unauthenticated session. Also, this issue only affects Asterisk 1.4.
Asterisk 1.2 is not affected. Systems that do not use chan_sip are also not
The security advisory is available at
The release is available for immediate download from
Thank you for your support!