MU Security Research Team has reported a vulnerability in Asterisk, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a NULL-pointer dereference error when handling SIP request messages. This can be exploited to crash the service via a specially crafted SIP message with no URI and SIP version sent to default port 5060/UDP.

The vulnerability is reported in version 1.4.0 and 1.2.15. Prior versions may also be affected.

Solution
Update to version 1.4.1 or 1.2.16.

Provided and/or discovered by
MU Security Research Team

Changelog
Further details available to Secunia VIM customers

Original Advisory
Asterisk:
http://asterisk.org/node/48320
http://asterisk.org/node/48319

MU Security:
http://labs.musecurity.com/advisories/MU-200703-01.txt

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers