Bug Hits Popular IP-PBX Apps

Users of two popular open-source VOIP applications could come under attack if they don't patch their software quickly, a security researcher said today.

The vulnerability could enable attackers to create buffer overflows in VOIP networks, effectively creating a denial-of-service attack on networks that use the software, according to Core Security Technologies, which discovered the threat.

Asterisk PBX, a widely used open-source application that provides private branch exchange features for VOIP networks, and IAX client, an open-source library that runs VOIP protocols for several IP software phones, are the two systems at risk. The two applications are widely used in small businesses where conventional IP-PBX software is too expensive. But Asterisk also serves as the underlying software for enterprise-level and service-provider products, such as Aspect Software's contact center application and SIPphone's Gizmo Project.

The two applications contain a design flaw in which they fail to check for malformed UDP packets, according to Ivan Arce, CTO at Core Security. "An attacker can easily create a buffer overflow by sending an abundance of packets that are too short," he says.

The open-source Asterisk group and Digium, which distributes Asterisk, have both made patches available for the vulnerability. However, like most open-source organizations, they have no automated means of distributing the patches, so they are encouraging users to come to them quickly for the updates.

Unpatched, the vulnerability could be serious for VOIP environments, because it is relatively easy to exploit. "If you're supporting VOIP, you have to let these [short] packets pass or risk losing service," Arce says. The Asterisk group agrees, stating that the vulnerability could lead to "random Asterisk server crashes via a relatively trivial exploit."

The vulnerability report deals another blow to VOIP security, which was rocked last week when two men were charged with stealing and reselling VOIP service from 15 service providers. (See Two Charged in VOIP Hacking Scandal.)

"I expect we'll see a lot more vulnerabilities like this in VOIP before we're through," Arce said. "VOIP is no different from any other IP traffic, and it is still relatively new. There will be a lot of bugs to work out."

— Tim Wilson, Site Editor, Dark Reading

Organizations mentioned in this story