News / Security
Asterisk advisory warns of IAX2 denial-of-service risk
A 2006 security warning said that a flood of IAX2 call requests could deny service to an Asterisk PBX by exhausting its ability to process new telephone calls.
A configuration-sensitive mitigation
Internet Security Systems said the problem affected older Asterisk versions and improperly configured installations of the then-current release. IAX2 was described as carrying VoIP call setup and call content between Asterisk systems; the risk arose when an attacker sent enough requests to overwhelm the PBX.
According to the advisory, version 1.2.10 could limit simultaneous unauthenticated calls from one user, but each installation needed to set the threshold low enough to reduce exposure while still allowing ordinary use. This is a dated advisory about a specific version and configuration, not a current hardening instruction.