AST-2012-013: ACL rules ignored when placing outbound calls by certain IAX2 users

           Asterisk Project Security Advisory - AST-2012-013

     Product        Asterisk                                              
     Summary        ACL rules ignored when placing outbound calls by      
                    certain IAX2 users                                    
Nature of Advisory  Unauthorized use of system                            
  Susceptibility    Remote Authenticated Sessions                         
     Severity       Moderate                                              
  Exploits Known    None                                                  
   Reported On      07/27/2012                                            
   Reported By      Alan Frisch                                           
    Posted On       08/30/2012                                            
 Last Updated On    August 30, 2012                                       
 Advisory Contact   Matt Jordan < mjordan AT digium DOT com >             
     CVE Name       CVE-2012-4737                                         

Description  When an IAX2 call is made using the credentials of a peer    
             defined in a dynamic Asterisk Realtime Architecture (ARA)    
             backend, the ACL rules for that peer are not applied to the  
             call attempt. This allows for a remote attacker who is       
             aware of a peer's credentials to bypass the ACL rules set    
             for that peer.                                               

Resolution  The ACL rules for peers defined in an ARA backend are now     
            honored. Users of chan_iax2 should upgrade to the corrected   
            versions; apply a provided patch; or define their IAX2 peers  
            outside of an ARA backend in a static configuration file.     

                           Affected Versions
            Product                Release Series     
     Asterisk Open Source               1.8.x         All versions        
     Asterisk Open Source               10.x          All versions        
      Certified Asterisk               1.8.11         All versions        
     Asterisk Digiumphones       10.x.x-digiumphones  All versions        
   Asterisk Business Edition            C.3.x         All versions        

                              Corrected In
               Product                              Release               
         Asterisk Open Source                   1.8.15.1, 10.7.1          
          Certified Asterisk                      1.8.11-cert7            
        Asterisk Digiumphones                 10.7.1-digiumphones         
      Asterisk Business Edition                     C.3.7.6               

                                Patches                         
                           SVN URL                              Revision  

http://downloads.asterisk.org/pub/security/AST-2012-013.1.8.diff Asterisk
1.8
http://downloads.asterisk.org/pub/security/AST-2012-013.10.diff Asterisk
10

   Links     https://issues.asterisk.org/jira/browse/ASTERISK-20186       

Asterisk Project Security Advisories are posted at                        
http://www.asterisk.org/security                                          
                                                                          
This document may be superseded by later versions; if so, the latest      
version will be posted at                                                 
http://downloads.digium.com/pub/security/AST-2012-013.pdf and             
http://downloads.digium.com/pub/security/AST-2012-013.html                

                            Revision History
      Date                 Editor                  Revisions Made         
08/27/2012         Matt Jordan              Initial Revision              

           Asterisk Project Security Advisory - AST-2012-013
          Copyright (c) 2012 Digium, Inc. All Rights Reserved.

Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.