Changes On IAX2 Protocol To Prevent VoIP DDOS (AST-2009-006)

Asterisk Security
Asterisk Security list has posted has  published Security Advisory - AST-2009-006 outlining the needs for changes.
There is an accompanying IAX2-security.pdf that has information on the advisory. The following is an excerpt from the posted information.
The IAX2 protocol uses a call number to associate messages with the call that they belong to. However, the protocol defines the call number field in messages as a fixed size 15 bit field. So, if all call numbers are in use, no additional sessions can be handled.             
A call number gets created at the start of an IAX2 message exchange. So, an attacker can send a large number of messages and consume the call number space. The attack is also possible using spoofed source IP addresses as no handshake is required before a call number is assigned.                                  
Purposed and advised resolution  is to upgrade to a version of Asterisk listed in this document as containing the IAX2 protocol security enhancements. In addition to upgrading, administrators should consult the users guide section of the IAX2 Security document (IAX2-security.pdf), as well as the sample configuration file for chan_iax2 that have been distributed with those releases for assistance with new options that have been provided.

+-----------------------------------------------------------------------+
   |                       Affected Versions                            |
   |--------------------------------------------------------------------|
   |             Product          | Release Series |                    |
   |------------------------------+----------------+--------------------|
   |       Asterisk Open Source   |     1.2.x      | All versions       |
   |------------------------------+----------------+--------------------|
   |       Asterisk Open Source   |     1.4.x      | All versions       |
   |------------------------------+----------------+--------------------|
   |       Asterisk Open Source   |     1.6.x      | All versions       |
   |------------------------------+----------------+--------------------|
   |    Asterisk Business Edition |     B.x.x      | All versions       |
   |------------------------------+----------------+--------------------|
   |    Asterisk Business Edition |     C.x.x      | All versions       |
   |------------------------------+----------------+--------------------|
   |    s800i (Asterisk Appliance)|     1.3.x      | All versions       |
   +--------------------------------------------------------------------+

   +-------------------------------------------------------------------+
   |                              Corrected In                         |
   |-------------------------------------------------------------------|
   |                   Product              |         Release          |
   |----------------------------------------+--------------------------|
   |            Asterisk Open Source        |          1.2.35          |
   |----------------------------------------+--------------------------|
   |            Asterisk Open Source        |         1.4.26.2         |
   |----------------------------------------+--------------------------|
   |            Asterisk Open Source        |         1.6.0.15         |
   |----------------------------------------+--------------------------|
   |            Asterisk Open Source        |         1.6.1.6          |
   |----------------------------------------+--------------------------|
   |          Asterisk Business Edition     |         B.2.5.10         |
   |----------------------------------------+--------------------------|
   |          Asterisk Business Edition     |         C.2.4.3          |
   |----------------------------------------+--------------------------|
   |          Asterisk Business Edition     |         C.3.1.1          |
   |----------------------------------------+--------------------------|
   |         S800i (Asterisk Appliance)     |         1.3.0.3          |
   +-------------------------------------------------------------------+

VoIP Phone Supports H.323,MGCP,SIP,IAX2 And Many Codecs

Multi Protocol VoIP Phone, YWH500
A Company in China, Zhengzhou Yuneng Communication Co., Ltd, has released a VoIP Phone that fits most of the VoIP networks that exists today.
As well as supporting H.323 MGCP SIP IAX2, the phone supports G.711, G.723.1, G729 codec among others. The phones lists following features as well;
Multi-Language support (Chinese,English,Japanese,German,French,Spanish,Italian)
Tone generation and Local DTMF generation and detection according with ITU-T
call hold;Unattended/ attended call transfer
call waiting and per call-waiting blocking
call forward (Always, busy, no answer, power off)
Large 2*16 LCD with blue back light
12 function keys for operating and setting phone besides standard keys 0-9,#
Hotline
80 entries each for missed calls, answered calls and dialed calls
100 entries for speed dial number
voice promote,configurable jitter buffer size,configurable audio frame
adjustable user password and super password
http, telnet, keypad and dedicate manage tool
URL based FTP,HTTP and TFTP auto provision
E.164 dial plan and customized dial rules

You can read more info at VoIP-Info.ORG article. Pricing was not indicated.

Tags: E.164 dial plan, H.323, MGCP, SIP, IAX2, VoIP Phone, G.711, G.723.1, G729

The Asterisk Development Team Releases The Asterisk 1.6.1.0

http://snapvoip.blogspot.com/

The Asterisk Development Team has released the Asterisk 1.6.1.0. Asterisk 1.6.1.0 is available for immediate download at Digium Downloads

This being the first in the 1.6.1 branch, there are additional features that are added since 1.6.0. Please see the CHANGES file for more information about the additional functionality

If you are upgrading from previous versions of Asterisk, like Asterisk 1.6.1.0-RC5, you are directed to review the UPGRADE.txt file.

Also do not forget to get Asterisk-Addons 1.6.1.0.

Notable changes in this release:
----------------------------------------------

* It is now possible to specify a pattern match as a hint. Once a phone subscribes to something that matches the pattern a hint will be created using the contents and variables evaluated.

* IAX2 encryption support has been improved to support periodic key rotation within a call for enhanced security. The option "keyrotate" has been provided to disable this functionality to preserve backwards compatibility with older versions of IAX2 that do not support key rotation.

* res_odbc no longer has a limit of 1023 total possible unshared connections, as some people were running into this limit. This limit has been increased to 4.2 billion.

* Several (ODBC, Postgres, MySQL, SQLite) realtime drivers have been given adaptive capabilities. What this means in practical terms is that if your realtime table lacks critical fields, Asterisk will now emit warnings to that effect. Also, some of the realtime drivers have the ability (if configured) to automatically add those columns to the table with the correct type and length.

* Config file variables may now be appended to, by using the '+=' append operator. This is most helpful when working with long SQL queries in func_odbc.conf, as the queries no longer need to be specified on a single line.

Tags: Asterisk 1.6.1.0, IAX2 encryption, IAX2, Asterisk 1.6.1.0-RC5

IAX2 Becomes RFC 5456, Congratulations RFC Team!

http://snapvoip.blogspot.com/
I saw this wonderful message on Asterisk Dev List posted by John Todd! Congratulations to hard working team, Ed Guy, Mark Spencer, Brian Capouch, Frank Miller, and Kenny Shumard! Now to find a good beer! Amoocon is a good place to celebrate this!

Mark and Ed received word today that the long-awaited RFC for IAX2 has
been approved by the IETF, and is now published:

http://www.rfc-editor.org/authors/rfc5456.txt

Thanks to Ed Guy, Mark Spencer, Brian Capouch, Frank Miller, and Kenny
Shumard!  Lots of revisions and discussions have paid off.

JT

---
John Todd                       email:jtodd at digium.com
Digium, Inc. | Asterisk Open Source Community Director
445 Jan Davis Drive NW -  Huntsville AL 35806  -   USA
direct: +1-256-428-6083         http://www.digium.com/

Tags: RFC 5456, IAX2, Asterisk, Ed Guy, Mark Spencer, Brian Capouch, Frank Miller, Kenny Shumard, Asterisk Dev List

Asterisk 1.6.0.6-rc1 Yours For The Taking

http://snapvoip.blogspot.com/
Asterisk Development team has released the Asterisk 1.6.0.6-rc1yesterday. This release of Asterisk fixes several issues related to overall stability and usability, especially with applications and their options. In addition, an issue with IAX2 transfers not taking place has been fixed. Issues found in this release candidate can be reported at http://bugs.digium.com/.
Download at http://downloads.digium.com/

Tags: Asterisk, Asterisk 1.6.0.6-rc1, IAX2