Asterisk contains a flaw related to the SIP Channel Driver that may allow a remote denial of service. The issue is triggered when parsing SIP UPDATE requests, which will result in loss of availability for the application.

Upgrade to version C.3.7.4 or higher for Business Edition or 1.8.11.1 or 10.3.1 or higher for Open Source, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1026963
• CVE ID: 2012-2416 (see also: NVD)
• Secunia Advisory ID: 48891 49536
• Related OSVDB ID: 81454 81455
• Vendor Specific Advisory URL: http://downloads.asterisk.org/pub/security/AST-2012-006.html
• Packet Storm: http://packetstormsecurity.org/files/112117/Asterisk-Project-Security-Advisory-AST-2012-006.html
• Mail List Post: http://seclists.org/bugtraq/2012/Apr/180
• Vendor Specific News/Changelog Entry: http://www.gentoo.org/security/en/glsa/glsa-201206-05.xml

• Thomas Arimont