[asterisk-bugs] [Asterisk 0016091]: Security Problem

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=16091 
====================================================================== 
Reported By:                thom4fun
Assigned To:                ebroad
====================================================================== 
Project:                    Asterisk
Issue ID:                   16091
Category:                   Channels/chan_sip/General
Reproducibility:            always
Severity:                   major
Priority:                   normal
Status:                     assigned
Asterisk Version:           1.6.1.6 
JIRA:                        
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
====================================================================== 
Date Submitted:             2009-10-18 03:22 CDT
Last Modified:              2009-10-19 13:45 CDT
====================================================================== 
Summary:                    Security Problem
Description: 
We use Asterisk 1.6.1.6.

It seems that Asterisk will ignore the deny and permit values.
I have a try just like in 1.4.... where it works fine, but if I use the
values:
deny=0.0.0.0/0.0.0.0
permit=192.168.30.10
the call will be executed from everywhere.

Also I try the insecure option but I do not find a reason to give some
special clients the possibility to make an invite without authentication.
It looks like: Everybody or Nobody!

Also we try to use these options in the file sip.conf and PGSQL database.

Are there some hints to get deny/permit to work?

Regards
Thomas

====================================================================== 

---------------------------------------------------------------------- 
 (0112431) thom4fun (reporter) - 2009-10-19 13:45
 https://issues.asterisk.org/view.php?id=16091#c112431 
---------------------------------------------------------------------- 
Have many thanks for your help and cooperation.
I will wait for your patch to have a try with it.
After patching the asterisk, I can give you more information regarding the
high load issue.

By the way, the information I give are wrong. First I get a lot of SIP
response code 500 before the CPU load will go higher and higher, but not at
130 Channels. This will be effect if I use more then 130 active calls with
more than round about 200 active Channels. Please sorry for the first wrong
information.

Regards
Thomas 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-10-19 13:45 thom4fun       Note Added: 0112431                          
======================================================================