[Asterisk-Security] Day early and a dollar short? (IAX2 and SIP problems)

[John Todd]

DoS notice for IAX2 here: http://xforce.iss.net/xforce/alerts/id/228

Of course, this has been "patched" in => 1.2.10 and is "old news" but 
it got me thinking...  Are we just as vulnerable with SIP from a 
similar threat?  I haven't tested, but was wondering if anyone had 
real-world examinations or testbed experiments they could share.  I 
seem to recall some discussion about time-scaled blocking of hosts or 
usernames that made repeatedly incorrect requests (similar to the 
flap dampening methods with some brands of routers.)   Would this 
help the problem or introduce a more dangerous threat from potential 
memory overloads?

While not exactly on-target, this thread discusses some of the 
issues: 
http://www.mail-archive.com/asterisk-dev@lists.digium.com/msg20804.html

JT