Security

Security Advisory: Vulnerability in Brekeke products could allow unauthorized use of phone lines
Published: March 11, 2009

[Affected Products]
OnDO PBX
OnDO SIP Server
Brekeke PBX (v2.2.7.6 or earlier)
Brekeke SIP Server (v2.2.7.6 or earlier)

[Solutions]

Enable REGISTER Authentication at SIP Server.
[Configuration]->[SIP]->[Authentication]->[REGISTER]="on"
Enable INVITE Authentication at SIP Server.
[Configuration]->[SIP]->[Authentication]->[INVITE]="on"
For Brekeke SIP Server users:
If you are using an ITSP, VoIP gateway or any other devices which can not handle INVITE Authentication, you may need the following Dial Plan rule to accept its INVITE requests without the Authentication.
Matching Patterns Deploy Patterns
$request = ^INVITE
$addr = <itsp or device ip address > $auth = false
$continue = true
For Brekeke PBX users:
Please update your Dial Plan rules by downloading the latest full dialplan rules from
http://www.brekeke-sip.com/download/pbx/dialplan/latest/dialplan.txt

From PBX v2.2.7.7 and later, the calls will be rejected by PBX when no ARS rule can be applied to the calls from/to non-registered users.
Also check Update Issues for PBX v2.2.7.7 and later .
For OnDO SIP Server users:
We strongly recommend that you upgrade to Brekeke SIP Server.
For OnDO PBX users:
Please block all ports except the following ports.
*We strongly recommend that you upgrade to Brekeke PBX.

TCP: 8080 or 28080 (For GUI access) *For Windows, the default is 28080.
UDP: 5060 (SIP port)
UDP: 10000-10999 (RTP ports for SIP Server)
UDP: 11000-11999 (RTP ports for PBX)
UDP: 12000-12999 (RTP ports for Media Server)

Matching Patterns	Deploy Patterns
$request = ^INVITE $addr = <itsp or device ip address >	$auth = false $continue = true

Username
Password
Remember me

System message

Security

Security