Potential Asterisk Security Issue Heightens Need for Updated Dial Plans

February 15, 2010

As more and more business users search for a more economical, manageable solution for their telephony needs, Asterisk (News - Alert)-based solutions in particular have emerged as a top choice for small- and medium-sized businesses.

Yet, a potential security issue remains with all releases of Asterisk. And to stay protected, users need to update their dial plans, according to a VentureVoip blog posting. The security problem doesn’t involve the code, but with the way users construct their dial plans.

The issues at hand, according to the blog, is a conflict exists between the allowed characters in the called number or name in many VoIP protocols and the way Asterisk handles channel variables. A security risk is hidden in many dial plans based on examples provided over time Asterisk developers, trainers and the community at large.

For example, by implementing an ampersand in the dial string, users can access protected resources or misuse the PBX (News - Alert) services, according to the blog.

“We need help from all involved in the Asterisk eco-system,” the blog said. “This is not something that the development team can solve by itself. We can add documents, READMEs and fix our own examples. But that won’t fix it. We need everyone involved to pump this information out in all the veins that runs through the Asterisk eco-system.”

Digium, the Asterisk company, plans to release an Asterisk Security Advisory document and updated examples within the Asterisk source code tree. The blog advises readers to audit their dial plans to help solve the problem.

Amy Tierney is a Web editor for TMCnet, covering business communications Her areas of focus include conferencing, SIP, Fax over IP, unified communications and telepresence. Amy also writes about education and healthcare technology, overseeing production of e-Newsletters on those topics as well as communications solutions and UC. To read more of Amy's articles, please visit her columnist page.

Edited by Amy Tierney

Article comments powered by Disqus

Digital Voice and Data

A108: Eight Port Digital Telephony Card

Choose the Sangoma Eight Port A108 Card to support up to 240 simultaneous voice calls over eight T1, E1 or J1 lines or up to 16.384 Mbps of full duplex data throughput.

Learn More | View Demo

A104: Four Port Digital Telephony Card

Choose the Sangoma Quad Port A104 Card to support up to 120 simultaneous voice calls over four T1, E1 or J1 lines or up to 8.192 Mbps of full duplex data throughput.

Learn More | View Demo

A102: Dual Port Digital Telephony Card

The Sangoma A102 Card supports up to 60 simultaneous voice calls over two T1, E1 or J1 lines or up to 4.096 Mbps of full duplex data throughput.

Learn More | View Demo

A101: Single Port Digital Telephony Card

The industry's first affordable single port T1/E1/J1 card with available Telco-grade hardware echo cancellation. It's designed for optimum voice support for smaller systems. The Sangoma A101 Card supports up to 30 simultaneous voice calls or 2.048 Mbps of full-duplex data throughput through a single T1, E1 or J1 line.

Learn More | View Demo

More Digital Voice and Data Cards »

Sangoma Customer Testimonials

Stephen Lewis, CTO - Your Golf Travel

I'm sure you get bored of people saying it, but I wanted to express my gratitude for your excellent support - it is without doubt the best I've encountered (across all the software and hardware organisations I've dealt with).

Particular thanks are due to Ben Bueno - I only wish we could find employees who are as skilled (and friendly!) as he is.

Gerry McHugh - Ashelle Networks Ltd.

I would like to thank you at Sangoma, especially Leo for your recent help with case #274. I definitely could not speak highly enough of your support system, and the fact that it is free is unbelievable, the support is so good I don't think any company would have a problem with paying for it.

I have Sangoma cards in all my trixbox systems, which may only be about 10, but I definitely will be using Sangoma for any future systems and interface cards I may need.

More Sangoma Testimonials »

Sangoma News

More Sangoma News »