ALERT RTP stream security risk

[ostridge]

and Incredible PBX for Raspbian:

sed -i 's|-A INPUT -p udp -m multiport --dports 10000:20000 -j ACCEPT|\#-A INPUT -p udp -m multiport --dports 10000:20000 -j ACCEPT|' /etc/iptables/rules.v4
sed -i 's|-A INPUT -p udp -m multiport --dports 10000:20000 -j ACCEPT|\#-A INPUT -p udp -m multiport --dports 10000:20000 -j ACCEPT|' /etc/iptables/rules.v4.ubuntu14

I applied the above on Raspbian, no errors but
when I did nano on /etc/iptables/rules.v4, nano couldn't find "-A INPUT -p udp -m multiport --dports 10000:20000 -j ACCEPT" (using ctrl+W )

Instead I found

-A INPUT -p udp -m udp --dport 10000:20000 -j ACCEPT

but no #. Also no mention of multiport

Same thing in rules.v4.ubunto14.

Shouldn't these code lines be included in the root logon updates utility?

 

[wardmundy]

Thanks, @ostridge. Fixed.

 

[merk]

Then you probably need to load one of the patches or update to the latest version of Asterisk.

Can you please provide any guidance how to apply the patch?

I tried to search online but couldnt figure out how to apply the .diff file.

Thanks in advance

 

[Jose Pinto]

Hi
I'm a little bit confused, I read this post on Blog Nerd Vittles Blog: "RTPbleed Security Alert: Asterisk Calls Can Be Intercepted" so for curiosity I just start to look at iptables and I did not find the line: -A INPUT -p udp -m udp --dport 10000:20000 -j ACCEPT , I find this line: -A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT.
After that I start to read this post I seams to me that @wardmundy already fixed the problem with the new install of 13-13 ( I made mine13-13 in last november), so I do not need to do any action, right?
TIA

 

[wardmundy]

Hi
I'm a little bit confused, I read this post on Blog Nerd Vittles Blog: "RTPbleed Security Alert: Asterisk Calls Can Be Intercepted" so for curiosity I just start to look at iptables and I did not find the line: -A INPUT -p udp -m udp --dport 10000:20000 -j ACCEPT , I find this line: -A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT.
After that I start to read this post I seams to me that @wardmundy already fixed the problem with the new install of 13-13 ( I made mine13-13 in last november), so I do not need to do any action, right?
TIA

Correct. It's been addressed.