[asterisk-bugs] [Asterisk 0015076]: Early media bridged from caller to callee allows free calls

[Asterisk Bug Tracker]

The following issue has been UPDATED. 
====================================================================== 
http://bugs.digium.com/view.php?id=15076 
====================================================================== 
Reported By:                fnordian
Assigned To:                tilghman
====================================================================== 
Project:                    Asterisk
Issue ID:                   15076
Category:                   Applications/app_dial
Reproducibility:            always
Severity:                   minor
Priority:                   normal
Status:                     assigned
Asterisk Version:           SVN 
Regression:                 No 
SVN Branch (only for SVN checkouts, not tarball releases): 1.6.1 
SVN Revision (number only!): 185949 
Request Review:              
====================================================================== 
Date Submitted:             2009-05-11 06:15 CDT
Last Modified:              2009-05-11 16:00 CDT
====================================================================== 
Summary:                    Early media bridged from caller to callee allows
free calls
Description: 
Hi,
german security press reported about this last week (
http://www.heise.de/security/Lauschangriff-in-VoIP-Netzen--/artikel/137297
). The problem occurs on receiving a call and placing it to an user.
Ringing and session progress data are bridged from the callee to the caller
and that's good. The bad thing is that media-data from the caller is
forwarded to the callee. This allows among other problems free calls. I
learned that this might be wanted behavior e.g. for call centers, but it's
not good for gateways.

There should be an option for Dial() to disable the forwarding of
media-data to the callee during call-setup.
====================================================================== 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-05-11 16:00 lmadsen        View Status              private => public   
======================================================================