[asterisk-dev] AST-2016-007: UPDATE

[Asterisk Security Team]

On September 8, the Asterisk development team released the AST-2016-007
security advisory. The security advisory involved an RTP resource
exhaustion that could be targeted due to a flaw in the "allowoverlap"
option of chan_sip. Due to new information presented to us by Walter
Doekes, we have made the following updates to the advisory.

In the "Description" section, the following text has been added:

    UPDATE (20 October, 2016):                                   
                                                                                  
    It has been brought to our attention by Walter Doekes that
    this same leak can be exploited without the use of the
    overlap dialing feature. Sending SIP requests in a specific
    sequence outside the norm could also cause the leak of RTP
    resources. By sending an in-dialog INVITE after receiving a
    404 response (but before sending an ACK), an attacker could
    cause the same leak to occur."

In the "Resolution" section, the following text has been added:

    UPDATE (20 October, 2016):                                    
                                                                  
    Because of the updated information from Walter Doekes,
    disabling the allowoverlap option is not enough to solve
    this issue. Users of Asterisk MUST upgrade to one of the
    fixed versions listed below.

The updated advisory can be found at
http://downloads.asterisk.org/pub/security/AST-2016-007.html
and
http://downloads.asterisk.org/pub/security/AST-2016-007.pdf