Asterisk t.38 Security Alert

[wardmundy]

A fairly serious bug in t.38 (aka Fax for Asterisk protocol) has been identified in all versions of Asterisk. We have released new PIAF-Gold, Silver, Bronze, and Purple payload files this morning which resolve the issue.

For details, see this Asterisk Security Release Announcement.

 

[shane]

Version 1.4.21.2 Updates

I have tried to follow the mantra of "If it's not broken don't fix it!"

With that in mind I am running 1.4.21.2 with the last SIP patch applied. Can anyone tell me if I can apply a patch for the t38 issue or do I need to work on upgrading the source? If I do need to update the source is there a painless way to do so?

As always thanks for the great site and all the help!

 

[malcolmd]

Howdy,

A couple of notes:

If T.38 is disabled in sip.conf, e.g. t38pt_udptl is set to "no," then you're not vulnerable.

You're also only vulnerable while authenticated calls are in progress. If your system is idling, no calls going on, then you're not vulnerable. That's not really any consolation though.

Cheers.

 

[wardmundy]

The FreePBX translation follows.

If you don't use T.38 faxing, make certain that the following line is included in PEER Details for all of your trunks connected to the outside world:

t38pt_udptl=no

 

[ChrisJ]

if I am using digium's free fax module with sip trunks, am I using t.38? how do I determine if t.38 is used in a sip trunk?

 

[malcolmd]

Do you have t38pt_udptl set to something other than no? Then, T.38 is enabled and as soon as someone makes an authenticated call through your system, you're vulnerable.

 

[wardmundy]

Here's the complete Security Advisory.

 

[centoasa]

Sorry, where is chan_sip file?
In my sip.conf (or related files) I can't found T38 (or similar)
Please, explain me.

 

[randy7376]

centoasa,

Check in /etc/asterisk/sip_general_additional.conf

Set t38pt_udptl=no if you intend to disable. I believe this is the default if you're not using Fax for Asterisk.

 

[centoasa]

I use Hylafax (and iaxmodem) for fax: I must disable however the T38?