[asterisk-bugs] [Asterisk 0016091]: Security Problem

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=16091 
====================================================================== 
Reported By:                thom4fun
Assigned To:                ebroad
====================================================================== 
Project:                    Asterisk
Issue ID:                   16091
Category:                   Channels/chan_sip/General
Reproducibility:            always
Severity:                   major
Priority:                   normal
Status:                     assigned
Asterisk Version:           1.6.1.6 
JIRA:                        
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2009-10-18 03:22 CDT
Last Modified:              2009-10-19 13:08 CDT
====================================================================== 
Summary:                    Security Problem
Description: 
We use Asterisk 1.6.1.6.

It seems that Asterisk will ignore the deny and permit values.
I have a try just like in 1.4.... where it works fine, but if I use the
values:
deny=0.0.0.0/0.0.0.0
permit=192.168.30.10
the call will be executed from everywhere.

Also I try the insecure option but I do not find a reason to give some
special clients the possibility to make an invite without authentication.
It looks like: Everybody or Nobody!

Also we try to use these options in the file sip.conf and PGSQL database.

Are there some hints to get deny/permit to work?

Regards
Thomas

====================================================================== 

---------------------------------------------------------------------- 
 (0112430) ebroad (manager) - 2009-10-19 13:08
 https://issues.asterisk.org/view.php?id=16091#c112430 
---------------------------------------------------------------------- 
insecure=invite should work in 1.6, though in my humble opinion, the
challenge authentication used by SIP is pretty insignificant as far as CPU
usage is concerned. With that said, permit/deny, at least from its design
intentions should restrict traffic on a per peer basis, though I am
discussing this with an Asterisk developer. Ill see if I can put together a
patch for this soon.. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-10-19 13:08 ebroad         Note Added: 0112430                          
======================================================================