The Asterisk.org development team has released Asterisk versions 1.4.19-rc4 and 1.6.0-beta7.

These releases contain significant bug fixes over the previous pre-releases of 1.4.19 and 1.6.0. We would like to thank everyone for all of the help with pre-release testing. Unless anything new comes up, 1.4.19 will be released at the beginning of next week.

Both releases are available for download from http://downloads.digium.com/.

Thank you for your support!

The Asterisk.org development team has released four new versions of Asterisk to address critical security vulnerabilities.

AST-2008-002 details two buffer overflows that were discovered in RTP codec payload type handling.

• http://downloads.digium.com/pub/security/AST-2008-002.pdf
• All users of SIP in Asterisk 1.4 and 1.6 are affected.

AST-2008-003 details a vulnerability which allows an attacker to bypass SIP authentication and to make a call into the context specified in the general section of sip.conf.

• http://downloads.digium.com/pub/security/AST-2008-003.pdf
• All users of SIP in Asterisk 1.0, 1.2, 1.4, or 1.6 are affected.

AST-2008-004 details some format string vulnerabilities that were found in the code handling the Asterisk logger and the Asterisk manager interface.

• http://downloads.digium.com/pub/security/AST-2008-004.pdf
• All users of Asterisk 1.6 are affected.

Asterisk 1.2.27 and 1.4.18.1 are releases that only contain changes to fix these security vulnerabilities.

In addition to fixes for these security issues, 1.4.19-rc3 and 1.6.0-beta6 contain a number of other bug fixes over the previous release candidates and beta releases for the upcoming 1.4.19 and 1.6.0 releases.

We encourage all affected users of these security vulnerabilities to upgrade their installations as time permits.

Thank you for your continued support of Asterisk!

The Asterisk.org development team has released Asterisk 1.4.19-rc2. This is a test release for 1.4.19. The official 1.4.19 release will be made after a 1.4.19 release candidate goes through a few days of testing without finding any major regressions. This release contains one crash regression that was found during testing of 1.4.19-rc1. It also includes a number of other bug fixes, as well.

This release is available for download as a tarball, as well as from svn. Please download and test this release and report any problems to http://bugs.digium.com/.

Release tarballs can be found here:

• http://downloads.digium.com/pub/telephony/asterisk/releases/

Thank you for your support!

The Asterisk.org development team has released Asterisk 1.6.0-beta5. As of this beta of 1.6.0, 1.6.0 is now feature frozen. In addition to a number of bug fixes, the following new features have been added since beta4:

• The SMDI interface in Asterisk has been reworked to fix a number of issues as well as add some new features. SMDI message information is now accessed in the dialplan using some new dialplan functions. New options have been added to map Asterisk voicemail boxes to SMDI station IDs. Also, MWI will now properly be sent for systems that have some external interface modifying voicemail boxes, such as a web interface, or with an email client in the case of IMAP storage.
• The Postgres CDR module now supports some of the features of cdr_adaptive_odbc. Specifically, you may add additional columns into the table and they will be set, if you set the corresponding CDR variable name. Also, if you omit columns in your database table, those fields will be silently skipped when inserting the record.
• The ResetCDR application now has an ‘e’ option that re-enables the CDR if it has been disabled using the NoCDR option.
• A new CLI command, “devstate change”, has been added which allows you to change the state of a Custom device. Custom device states were previously only settable by using the DEVICE_STATE() dialplan function.
• The Originate manager action now has its own permission level called originate. Also, if you want this action to be able to execute applications that call out to a subshell, it requires the system privilege, as well. These changes were made to enhance the security of the manager interface.

For a full list of features that have been introduced from Asterisk 1.4 to Asterisk 1.6.0, see the following file:

• http://svn.digium.com/view/asterisk/branches/1.6.0/CHANGES?view=markup

For a full list of changes to Asterisk 1.6.0 from beta4 to beta5, see the ChangeLog:

• http://svn.digium.com/view/asterisk/tags/1.6.0-beta5/ChangeLog?view=markup

There are a few more issues to resolve in 1.6.0 before it can enter release candidate status, but we expect that to happen relatively soon.

Thank you for your continued support of Asterisk!

The Asterisk.org development team has released Asterisk 1.4.19-rc1. This is a test release for 1.4.19. The official 1.4.19 release will be made after a 1.4.19 release candidate goes through a few days of testing without finding any major regressions.

This release is available for download as a tarball, as well as from svn. Please download and test this release and report any problems to http://bugs.digium.com/.

Release tarballs can be found here:

• http://downloads.digium.com/pub/telephony/asterisk/releases/

Thank you for your support!