A vulnerability has been reported in Asterisk, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a null-pointer dereference error within the handling of the "BYE/Also" transfer method and can be exploited to crash the application.

Successful exploitation requires that a dialog has already been established.

The vulnerability is reported in the following versions:
* Asterisk Open Source 1.4.x prior to version 1.4.17
* Asterisk Business Edition C.x.x prior to version C.1.0-beta8
* AsteriskNOW pre-release prior to beta7
* Asterisk Appliance Developer Kit prior to Asterisk 1.4 revision 95946
* s800i (Asterisk Appliance) 1.0.x prior to version 1.0.3.4

Solution
Asterisk Open Source:
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits Grey VoIP.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://downloads.digium.com/pub/security/AST-2008-001.html

Deep Links
Links available to Secunia VIM customers