Two vulnerabilities have been reported in Asterisk, which can be exploited by malicious users to cause a DoS (Denial of Service).

1) An error when handling a provisional response from an endpoint during a re-invite can be exploited to consume all RTP ports resulting in inability to make further calls.

Successful exploitation of this vulnerability requires an attacker to have the ability to place calls.

2) A double-free error exists when a single voicemail account is manipulated by two callers at the same time and can be exploited to cause a crash.

Please see the vendor's advisory for a list of affected versions.

Solution
Apply patches (please see the vendor's advisory for details).

Provided and/or discovered by
The vendor credits:
1) Steve Davies
2) Nicolas Bouliane, Avencall Security Labs

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://downloads.asterisk.org/pub/security/AST-2012-010.html
http://downloads.asterisk.org/pub/security/AST-2012-011.html

Deep Links
Links available to Secunia VIM customers