In the Skinny channel driver, KEYPAD_BUTTON_MESSAGE events are queued for processing in a buffer allocated on the heap, where each DTMF value that is received is placed on the end of the buffer. Since the length of the buffer is never checked, an attacker could send sufficient KEYPAD_BUTTON_MESSAGE events such that the buffer is overrun.

Now, the length of the buffer is now checked before appending a value to the end of the buffer.

Affected Versions:

• Product Release Series
• Asterisk Open Source 1.6.2.x All Versions
• Asterisk Open Source 1.8.x All Versions
• Asterisk Open Source 10.x All Versions

Corrected In Product Release:

• Asterisk Open Source 1.6.2.24, 1.8.11.1, 10.3.1

A user of the Asterisk Manager Interface can bypass a security check and execute shell commands when they lack permission to do so. Under normal conditions, a user should only be able to run shell commands if that user has System class authorization. Users could bypass this restriction by using the MixMonitor application with the originate action or by using either the GetVar or Status manager actions in combination with the SHELL and EVAL functions. The patch adds checks in each affected action to verify if a user has System class authorization. If the user does not have those authorizations, Asterisk rejects the action if it detects the use of any functions or applications that run system commands.

Asterisk now performs checks against manager commands that cause these behaviors for each of the affected actions.

The following versions are affected:

• Asterisk Open Source 1.6.2.x All versions
• Asterisk Open Source 1.8.x All versions
• Asterisk Open Source 10.x All versions
• Asterisk Business Edition C.3.x All versions

Corrected In Product Release:

• Asterisk Open Source 1.6.2.24, 1.8.11.1, 10.3.1
• Asterisk Business Edition C.3.7.4

What is directmedia?

To put it simply, is the process where Asterisk tries to redirect the RTP media stream to go directly from the caller to the callee. Be careful that some devices do not support this (especially if one of them is behind a NAT). The default setting is YES.

When to use it?

If you have all clients behind a NAT, or for some other reason want Asterisk to stay in the audio path, you may want to turn this off.

If you want to allow media path redirection (reinvite) only when the peer where the media is being  sent is known to not be behind a NAT (as the RTP core can determine it based on the apparent IP address the media arrives from), set this to nonat.

The Asterisk Development Team has announced the release of Asterisk 10.3.0. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk

The release of Asterisk 10.3.0 resolves several issues reported by the community and would have not been possible without your participation. Thank you!

The following are the issues resolved in this release:

* — Fix potential buffer overrun and memory leak when executing “sip
show peers”
(Closes issue ASTERISK-19231. Reported by Thomas Arimont, Jamuel Starkey)

* — Fix ACK routing for non-2xx responses.
(Closes issue ASTERISK-19389.)

* — Remove possible segfaults from res_odbc by adding locks around
usage of odbc handle
(Closes issue ASTERISK-19011. Reported by Walter Doekes)

* — Fix blind transfer parking issues if the dialed extension is not
recognized as a parking extension.
(Closes issue ASTERISK-19322. Reported by aragon)

* — Copy CDR variables when set during a bridge
(Closes issue ASTERISK-16990.)

* — push ‘outgoing’ flag from sig_XXX up to chan_dahdi
(Closes issue ASTERISK-19316. Reported by Jeremy Pepper)

For a full list of changes in this release, please see the ChangeLog:

http://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-10.3.0

Thank you for your continued support of Asterisk!