A vulnerability has been reported in Asterisk, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to improper verification of ACK responses during IAX2 handshakes, which can be exploited to spoof an IAX2 handshake and cause a DoS via high bandwidth usage.

The vulnerability is reported in the following versions:
* Asterisk Open Source 1.0.x (all versions)
* Asterisk Open Source 1.2.x (all versions prior to 1.2.28)
* Asterisk Open Source 1.4.x (all versions prior to 1.4.19.1)
* Asterisk Business Edition A.x.x (all versions)
* Asterisk Business Edition B.x.x (all versions prior to B.2.5.2)
* Asterisk Business Edition C.x.x (all versions prior to C.1.8.1)
* AsteriskNOW 1.0.x (all versions prior to 1.0.3)
* Asterisk Appliance Developer Kit 0.x.x (all versions)
* s800i (Asterisk Appliance) 1.0.x (all versions prior to 1.1.0.3)

Solution
Asterisk Open Source 1.2.x:
Further details available to Secunia VIM customers

Provided and/or discovered by
Joel R. Voss a.k.a. Javantea

Changelog
Further details available to Secunia VIM customers

Original Advisory
Asterisk:
http://downloads.digium.com/pub/security/AST-2008-006.html

AltSci:
https://www.altsci.com/concepts/page.php?s=asteri&p=2

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers