System message

Security

Security Advisory: Vulnerability in Brekeke products could allow unauthorized use of phone lines

[Affected Products]
OnDO PBX
OnDO SIP Server
Brekeke PBX (v2.4.6.7 or earlier)
Brekeke SIP Server (v2.4.6.7 or earlier)

[Solutions]

• More at wiki page Avoid attacks
  
  
• Access Brekeke product admintool with SSL
  
  
• Update Brekeke products to latest version
  
  
• Enable REGISTER Authentication at SIP Server.
  [Configuration]->[SIP]->[Authentication]->[REGISTER]="on"
  
  
• Enable INVITE Authentication at SIP Server.
  [Configuration]->[SIP]->[Authentication]->[INVITE]="on"
  
  
• For Brekeke SIP Server users:
  If you are using an ITSP, VoIP gateway or any other devices which can not handle INVITE Authentication, you may need the following Dial Plan rule to accept its INVITE requests without the Authentication.
  

  Matching Patterns	Deploy Patterns
  $request = ^INVITE $addr = < Remote_Address >	$auth = false $continue = true

  
  
• For Brekeke PBX users:
  Please update your Dial Plan rules by downloading the latest full dialplan rules from
  http://www.brekeke-sip.com/download/pbx/dialplan/latest/dialplan.txt
  
  From PBX v2.2.7.7 and later, the calls will be rejected by PBX when no ARS rule can be applied to the calls from/to non-registered users.
  Also check Update Issues for PBX v2.2.7.7 and later .
  
  
• For OnDO SIP Server users:
  We strongly recommend that you upgrade to Brekeke SIP Server.
  
  
• For OnDO PBX users:
  Please block all ports except the following ports.
  *We strongly recommend that you upgrade to Brekeke PBX.
  
  TCP: 8080 or 28080 (For GUI access) *For Windows, the default is 28080.
  UDP: 5060 (SIP port)
  UDP: 10000-10999 (RTP ports for SIP Server)
  UDP: 11000-11999 (RTP ports for PBX)
  UDP: 12000-12999 (RTP ports for Media Server)