Asterisk 1.8.28-cert3, 1.8.32.1, 11.6-cert8, 11.14.1, 12.7.1, 13.0.1 Now Available (Security Release)

The Asterisk Development Team has announced security releases for Certified Asterisk 1.8.28 and 11.6 and Asterisk 1.8, 11, 12, and 13. The available security releases are released as versions 1.8.28-cert3, 11.6-cert8, 1.8.32.1, 11.14.1, 12.7.1, and 13.0.1.

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The release of these versions resolves the following security vulnerabilities:

  • AST-2014-012: Unauthorized access in the presence of ACLs with mixed IP address families
    Many modules in Asterisk that service incoming IP traffic have ACL options (“permit” and “deny”) that can be used to whitelist or blacklist address ranges. A bug has been discovered where the address family of incoming packets is only compared to the IP address family of the first entry in the list of access control rules. If the source IP address for an incoming packet is not of the same address as the first ACL entry, that packet bypasses all ACL rules.
  • AST-2014-018: Permission Escalation through DB dialplan function
    The DB dialplan function when executed from an external protocol, such as AMI, could result in a privilege escalation. Users with a lower class authorization in AMI can access the internal Asterisk database without the required SYSTEM class authorization. In addition, the release of 11.6-cert8 and 11.14.1 resolves the following security vulnerability:
  • AST-2014-014: High call load with ConfBridge can result in resource exhaustion
    The ConfBridge application uses an internal bridging API to implement conference bridges. This internal API uses a state model for channels within the conference bridge and transitions between states as different things occur. Unload load it is possible for some state transitions to be delayed causing the channel to transition from being hung up to waiting for media. As the channel has been hung up remotely no further media will arrive and the channel will stay within ConfBridge indefinitely.

In addition, the release of 11.6-cert8, 11.14.1, 12.7.1, and 13.0.1 resolves the following security vulnerability:

  • AST-2014-017: Permission Escalation via ConfBridge dialplan function and AMI ConfbridgeStartRecord Action
    The CONFBRIDGE dialplan function when executed from an external protocol (such as AMI) can result in a privilege escalation as certain options within that function can affect the underlying system. Additionally, the AMI ConfbridgeStartRecord action has options that would allow modification of the underlying system, and does not require SYSTEM class authorization in AMI.

Finally, the release of 12.7.1 and 13.0.1 resolves the following security vulnerabilities:

  • AST-2014-013: Unauthorized access in the presence of ACLs in the PJSIP stack
    The Asterisk module res_pjsip provides the ability to configure ACLs that may be used to reject SIP requests from various hosts. However, the module currently fails to create and apply the ACLs defined in its configuration file on initial module load.
  • AST-2014-015: Remote crash vulnerability in PJSIP channel driver
    The chan_pjsip channel driver uses a queue approach for relating to SIP sessions. There exists a race condition where actions may be queued to answer a session or send ringing after a SIP session has been terminated using a CANCEL request. The code will incorrectly assume that the SIP session is still active and attempt to send the SIP response. The PJSIP library does not expect the SIP session to be in the disconnected state when sending the response and asserts.
  • AST-2014-016: Remote crash vulnerability in PJSIP channel driver
    When handling an INVITE with Replaces message the res_pjsip_refer module incorrectly assumes that it will be operating on a channel that has just been created. If the INVITE with Replaces message is sent in-dialog after a session has been established this assumption will be incorrect. The res_pjsip_refer module will then hang up a channel that is actually owned by another thread. When this other thread attempts to use the just hung up channel it will end up using a freed channel which will likely result in a crash.

For more information about the details of these vulnerabilities, please read security advisories AST-2014-012, AST-2014-013, AST-2014-014, AST-2014-015, AST-2014-016, AST-2014-017, and AST-2014-018, which were released at the same time as this announcement. For a full list of changes in the current releases, please see the ChangeLogs:

The security advisories are available at:

Thank you for your continued support of Asterisk!

What can we help you find?

Download Asterisk

Get Started

Other Resources