News: U.S. E911 Reminder

Note: Good old Trixter has posted some the update on now what happens if you VoIP provider does not give you E911 support


Just a reminder last Monday at midnight was the deadline for pstn connected VoIP providers operating in the US to provide E911 or face fines upto $11,000 per day. There is also a filing requirement with the FCC which is due tonight as well.



Enforcement Bureau Outlines Requirements of November 28, 2005 Interconnected Voice Over Internet Protocol 911 Compliance Letters:
http://www.fcc.gov/eb/Public_Notices/DA-05-2945A1.html


Consumer page but has some basic info:
http://ftp.fcc.gov/cgb/consumerfacts/voip911.html

Announce: New Philippines Asterisk Mailing List / Yahoo! Group

Hello Pinoy Asteriskers(PINOY AKO! PINOY TAYO!),

This is also an annoucement of a new mailist list for Filipino Asterisk users.

Please Visit: http://groups.yahoo.com/group/asterisk-ph

Thanks,
Lito

News: Asterisk project converts to Subversion version control system

The Asterisk development team is pleased to announce that we have migrated our project repositories and development processes over to the Subversion version control system!

Effective immediately, the primary source code distribution point for Asterisk, Zaptel and other related projects (other than release tarballs of course) will be http://svn.digium.com.

The actual SVN repositories are available at http://svn.digium.com/svn, and there is a ViewCVS web viewer available at http://svn.digium.com/view. There is a separate repository for each major project, and each repository is organized in the typical Subversion fashion... for example, the Asterisk repository is organized as follows:

http://svn.digium.com/svn/asterisk/trunk (was CVS HEAD)
http://svn.digium.com/svn/asterisk/branches/1.2 (was CVS v1-2)
http://svn.digium.com/svn/asterisk/tags/1.2.0 (was CVS v1-2-0)

Other branches and tags are named similarly. Builds of Asterisk made from the new repositories will report a 'show version' tag made of the SVN branch name and the repository revision number that was checked out (unlike the CVS 'show version' tags which incorporated the date/time of checkout).

The 'asterisk-cvs' mailing list has been renamed to 'svn-commits' and will continue to receive commit messages for the all the major projects on our SVN server (existing subscriptions are still in effect). In addition, there are new project specific commit mailing lists as well:

asterisk-commits
asterisk-addons-commits
zaptel-commits
libpri-commits
libiax2-commits

All of these lists are available on lists.digium.com. Additionally, the commit messages will contain 'X-SVN-Author' and 'X-SVN-Branch' mail headers to allow you to sort/filter the commit messages in any way you wish.

One of the major benefits of this transition is that we will be opening up 'developer branches' for Asterisk Development Team members to be able to work on projects and make them available for public review, testing and participation; look for another announcement later this week when that process is ready.

For the near future, we will continue to provide access to source code via CVS using the same servers/paths that you have previously been using; once every day, the relevant Subversion branches will be copied over into CVS and brought up to date. We expect to keep updating CVS HEAD this way for three to six months; the other branches will be maintained for six to nine months. However the CVS repositories will be
updated in a single commit each day and will not contain any detailed revision history for the changes that are made. We encourage all users to transition to using Subversion for tracking development as soon as possible.

(Special thanks to chipig, sussman, darix, jerenkrantz, eh, mbk and the others on #svn-dev who helped solve some sticky issues on Saturday evening of Thanksgiving weekend )

New Mailing List: AstCallCenters

Hello ,

This is an announcement of a new mailing list dedicated to deploying, running and managing real-world Asterisk-based call centers. The mailing list is in English and allows knowledge sharing for this very important - and yet somehow less considered - Asterisk deployment area.


The homepage is located at http://groups.yahoo.com/group/astcallcenters/


Yours,
l.

Announce: Asterisk-Java 0.2 released

Asterisk-Java 0.2, a Java control for the Asterisk PBX, has been released.

The Asterisk-Java package consists of a set of Java classes that allow you to easily build Java applications that interact with an Asterisk PBX Server. Asterisk-Java supports both interfaces that Asterisk provides for this scenario: The FastAGI protocol and the Manager API.

The 0.2 release focuses on the new features of the Asterisk 1.2 series though it still supports Asterisk 1.0.x. Since 0.2-rc2 some minor bugs have been fixed and support for several last minute additions to Asterisk 1.2 has been added.

Asterisk-Java is used in several commercial environments and by the following Open Source projects:
* Asterisk-IM
A plugin for the Jive Messenger XMPP (jabber) server. It provides
integrated presence between your IM client and phone, notification
of incoming calls by IM and originate calls from supported IM
clients.
* Asterisk Desktop Manager (ADM)
A desktop application that will allow for automatic on-call volume
reduction, one click dial from clipboard, integrated phonebook
and more.

Asterisk-Java is available under Apache 2.0 license at:
http://www.asteriskjava.org

Announce: PhoneCALL version 2.7-RC1 Released!

Dustin Wildes posted details about the new version of PhoneCall.

Hello Everyone!
For all of you PhoneCALL users, we have a treat for you today as PhoneCALL 2.7-RC1 has been released!

We've worked hard to make this release as close to as bug-free as possible, but in the event you find a bug - PLEASE report it to the bugtracker. It doesn't matter how small of a 'bug' or problem you think it is - all input helps and makes the program better for everyone.

The bug tracker is at:
http://bugs.vecsector.com

Get your copy of PhoneCALL in the Downloads section at:
http://www.vecsector.com/phonecall
http://www.vecsector.com/phonecall/modules.php?name=Downloads



INFO on 2.7-RC1

New System Features include:
---------------------------------
-- Better script handling of Arguments
-- New Queue Configuration
-- New Conference(MeetMe) configuration
-- Defaults configuration for SIP/IAX/Voicemail
-- Easy to use Installation Wizard
-- Better Multi-Tenant Support
-- More Security Enhances for user groups
-- New user-login methods from accounts
-- DID Manager implemented
-- New Provider/Trunk manager
-- More Advanced configuration options for accounts
-- Beginning of Wizard API
-- New Context Manager (for creating custom contexts)


Thanks!!
Dustin Wildes

Announce: PhoneCALL version 2.7-RC1 Released!

Dustin Wildes posted details about the new version of PhoneCall.

Hello Everyone!
For all of you PhoneCALL users, we have a treat for you today as PhoneCALL 2.7-RC1 has been released!

We've worked hard to make this release as close to as bug-free as possible, but in the event you find a bug - PLEASE report it to the bugtracker. It doesn't matter how small of a 'bug' or problem you think it is - all input helps and makes the program better for everyone.

The bug tracker is at:
http://bugs.vecsector.com

Get your copy of PhoneCALL in the Downloads section at:
http://www.vecsector.com/phonecall
http://www.vecsector.com/phonecall/modules.php?name=Downloads



INFO on 2.7-RC1

New System Features include:
---------------------------------
-- Better script handling of Arguments
-- New Queue Configuration
-- New Conference(MeetMe) configuration
-- Defaults configuration for SIP/IAX/Voicemail
-- Easy to use Installation Wizard
-- Better Multi-Tenant Support
-- More Security Enhances for user groups
-- New user-login methods from accounts
-- DID Manager implemented
-- New Provider/Trunk manager
-- More Advanced configuration options for accounts
-- Beginning of Wizard API
-- New Context Manager (for creating custom contexts)


Thanks!!
Dustin Wildes

Announce: AstPlanDesigner 0.1

What is AstPlanDesigner?
* It is a graphical tool to design/draw Asterisk dial plan (extension.conf).
* It is free.
* It is implemented in Java.
* In version 0.1, it includes Asterisk command: Background,Dial,Hangup,setVar,Voicemail,SayNum,GotoIf and database function implemented in AGI.

Click Here for More Information

Click Here to Download

Click Here to Get the Java Runtime Enviroment(JRE)

Announce: Asterisk versions after the 1.2 release

Note: Ollie has posted some clarifications about the different versions of Asterisk released.

Friends in the Asterisk community,

There have been a lot of questions about Asterisk version numbers on the mailing lists. Here's a clarification:

* Executive summary
-------------------
- Asterisk 1.2 = RELEASE version (previously called "stable")
Asterisk 1.2.0 = First release of 1.2 (released now)
Asterisk 1.2.1 = Second release of 1.2 (not out yet)
- Asterisk 1.0 = old version, not maintained any more
Asterisk 1.0.9 = Final release of Asterisk 1.0
- Asterisk 1.3 = DEVELOPMENT code base, dangerous territory



* Asterisk 1.2 is the RELEASE version
-------------------------------------
This version is maintained in the v1-2 CVS branch. The released code, that you want to use in production servers, is released as tar.gz archives on ftp.digium.com and mirrors. These reflect the tagged CVS code, the first tag in the 1.2 tree being v1-2-0. The next release will be version 1.2.1, consisting of updated code including bug fixes that has been done since the 1.2 release date. From the minute of the
release, we've had a lot of interest in testing the new version and a constant flow of bug reports.

You do not want to follow the v1-2 CVS tree in production, since it is changing quite a lot and not all changes are tested and stabilized. After testing, we product tar.gz archives that you want to use. Make sure you subscribe to the asterisk-announce mailing list to get updates if you do not follow the massive flow of messages in asterisk-users.

For the 1.2 tree functionality is frozen. No new functionality is added to this code. The rule is that we only apply additional documentation and bug fixes to a release version.

* Asterisk 1.0 is no longer maintained
--------------------------------------
The old release version, 1.0 is no longer maintained, apart from the possibility of serious security bugs that needs to be fixed. This code is over one year old now and we've successfully managed to avoid adding new functionality to it since the release in september 2004. Before filing a bug report for a 1.0 version, make sure you also test the 1.2 version - a lot of things have been fixed in 1.2. If the bug exists in
1.2, go ahead and make a note in the bug report that it doesn't work in either version.


* Asterisk 1.3 is the new development code base
-----------------------------------------------
"CVS head" is the name currently used for the development code base, which now is on version 1.3dev. This is the base for a future 1.4 RELEASE.

During the development process of 1.3, we will move from CVS as a versioning system to "subversion", a new system used by many open source projects. "cvs head" will not be a useful name for 1.3dev for much longer.

WARNING :: Be warned that developers will go crazy with this code after a long period of bug-fixing and release engineering with 1.2. New things will be added quickly, and this version may or may not work at all from time to time. A lot of quite large internal architectures changes will be implemented in 1.3. These will have to be tested and propably cause a lot of very interesting craches, from a coding perspective. From a user perspective, those crashes will not be interesting or fun at all. Avoid the development tree in production use.

I hope this message clarifies the confusion a bit.

Regards,
/Olle

Release: New firmware for Aastra/Sayson IP phones

Note: Iain Barker posted details about the new firmware revision for the Aastra and Sayson IP phones.

Aastra Telecom has released SIP v1.3 firmware for the Aastra/Sayson range of IP phones.

This is a major update compared to firmware 1.2.x with many bugfixes and Asterisk(tm) interop limitations fixed.

The firmware, updated manuals and release notes are available for download at:
http://www.aastra.com/support/enterpriseip

New features include XML scripting support, enhanced integration for Asterisk(tm), Busy Lamp Field (BLF), Multiple SIP Proxy support, HTTP/FTP/TFTP config, encrypted config support, and a complete overhaul of the user and admin documentation.

I've posted a quick summary at http://www.voip-info.org/wiki/view/Aastra+480i
- email "nadlab at aastra.com" if you would like a PDF copy of the full spec sheet.

ps. Also available is firmware v1.2 for the Aastra CNX, an Asterisk(tm) based conference bridge.

Announce: AstLinux 0.2.9 Released

Note: Kristian Kielhofner has posted details about the new release of AstLinux

Hello Everyone,

I have finished up work on what will (hopefully) become AstLinux 0.3.0.

AstLinux 0.2.9 has been released as a test release.

Changes:
- Asterisk 1.2.0
- Zaptel 1.2.0
- libpri 1.2.0
- Sangoma wanrouter beta1-2.3.4
- Linux kernel 2.6.13.3
- improved QoS support
- dozens of changes brought in from -testing

ISO and CF images can be downloaded from http://www.astlinux.org. If everything goes smoothly, 0.3 should be out by mid-week.

Thanks!

--
Kristian Kielhofner

Announce: AstBill Live CD with Asterisk 1.2 Released

Do you want to quickly test out the new stable Asterisk 1.2. The AstBill team have now released a Brand new Asterisk Live CD together with latest version of AstBill version 0.9.0.13.

AstBill Live CD contains AstBill, Asterisk 1.2 and MySQL 5.0.15 and is based on DSL and Knoppix.

Run your personal Web Based IP PBX. No installation. Just boot from the CD or install to your hard disk.

The latest version of AstBill is fully functional with Asterisk 1.2 using Realtime as well as several bug fixes. There is improved prefix handling in trunks including a new US prefix option adding 011 to the trunk only when dialing outside the US.

The pricelist and brands module is improved and more user-friendly.

We strongly recommend you upgrade to the latest version.

Are Casilla
http://astartelecom.com - Independent VOIP Telecoms Broker. Asterisk Consultants
http://astbill.com - Open Source Billing, Routing and Management software for Asterisk and VOIP
AstBill DEMO: http://demo.astbill.com

Review: Linksys SPA-941 SIP Business Phone

Note: Someone has emailed me a link to this nice review on VoIPSpeak. Thnx!



Sipura was one of the first manufacturers to make a name for themselves in the VoIP arena. Sipura's analog telephone adapters (ATA) helped put Sipura on the map. Sipura's first foray into an actual phone (the SPA-841) was met with a lukewarm reaction. Shortly after the 841 was released, Cisco-owned Linksys, who was already licensing much of Sipura's technology, took a big jump into the game by purchasing Sipura. With the rebranding of the Sipura products we have been waiting to see what would come out next. The time has finally come it was worth the wait. The Linksys SPA-941 Business Phone feels like a cross between the 841 and the Cisco 7940 combining the features of the 841 with the style and quality of the Cisco phones.

Click Here to Read the Full Review

Announce: AMP (Asterisk Management Portal) 1.10.010 released

Note: Ryan Courtnage has posted details about the new AMP release.

Hello All,

We are pleased to announce the latest release of Asterisk Management Portal (AMP 1.10.010). This version includes support for Asterisk 1.2, an improved Device/User implementation, improved support for phones with Busy Lamp Indicators (ie: HINT extensions), improved ARI, as well as several bug fixes.

More information about AMP can be found at:
http://amp.coalescentsystems.ca

The AMP project page is here:
http://sourceforge.net/projects/amportal/

Please use our mailing lists to discuss AMP:
http://sourceforge.net/mail/?group_id=121515



Changes:
1.10.010

- Tested with Asterisk 1.2
- Tested with PHP 5
- Removed all the sound files from AMP archive, instead depend on asterisk-sounds
- Ability to execute a script after applying changes in the AMP interface (see amportal.conf in source archive)
- Allow accountcode for IAX devices (again)
- Show custom extensions in FOP
- Allow mailbox setting for device to be set manually (for shared mailboxes)
- HINT extensions are now created for both FIXED and ADHOC devices
- Display AMP version in footer
- Support for remote mysql database
- ARI upgrade adds i18n, user settings, and bug fixes
- Remove Play Next option from voicemail options and default to play next when deleting or saving voicemails
- Allow Asterisk Dial() options to be configured (General Settings)
- Lots'o'bug fixes

--
Ryan Courtnage
Director & CTO
Coalescent Systems Inc.
Enabling Open Source Telephony
403.244.8089
www.coalescentsystems.ca

News: (AMUG) Asterisk Montreal User Group: Mailing List + Next Meeting Info

Hi Montreal Users,

I have just setup a mailing list for the Asterisk Montreal User Group (AMUG).
You will find the registration link on the wiki page:
http://amug.modulis.ca

Next meeting: Thursday 24 Nov 2005 at 4:45pm.
Meeting will be hold at http://openface.ca office,
3445 Av. Parc, Montreal, QC, CA, H2X 2H6


See you there,

Adrian

Announce: New asterisk management tool

Although I posted a demo a couple of weeks back, we have a new release of our management gui that has a lot more user friendly features and has gone through a bunch of testing. Still no name for it as it's mostly an internal project, but we will come up with something asap. Right now I believe it's ready for more input from the community. Before being read for beta testing we want to get some documentation out. For the brave there is a download at http://asterisk.paymentonline.net.

Althought the web gui is fairly straight forward, underneath are some features we hope will be useful. Here is a basic feature rundown.

Features:
* Transparent multi tenant support.
* Template/Scripting system that allows a lot of different ways of laying out the dialplan and configuration menus. It doesn't lock you into using any particular layout, and it won't interfere with your existing configuration. Distributions can be easily created that have different layouts or menus.
* Does not need to run on the same server as asterisk. You can run a simple distributed ruby proxy on asterisk which will proxy all requests to read/write files.
* Uses ruby on rails which provides a good MVC structure for the code. Should be easier to modify then a typical php application.
* Can use postgresql, mysql, or sqlite3.
* Easy installation.
* Built in asterisk manager client and proxy.
* Separate web gui for voicemail users.
* Runs on linux and bsd. It should also run on windows we just haven't had the time to test that yet.

All of that said there are still a few things that need to be done. Queues, conferences, and call parking can't be managed yet, but that's simply because we left them to last. Should be another week before those get in. Zaptel configuration will probably come last, as we have no need for it but will add it anyways since others will probably want it. A large part of the system is the templating and scripting engine, which is not documented as of yet. We also need to add some more default scripts. The demo is pretty light but enough to give an idea of what you can do.

You can view the demo at http://asterisk.paymentonline.net:3000. The user login is 'demo', password 'changeme'. The admin login is 'admin', password 'changeme'. Although it's easy enough to reset everything, deleting things in the admin interface will make the demo a lot less usable, so please be kind:)

If you do want to install the distribution and play with it, it won't touch any of your asterisk configuration files so don't worry about that. You might need to email me about where to put the appropriate #include statements though, as I don't think that is covered in docs/INSTALL.

And everything except for the Payment Online name and logo is BSD licensed.

Chris

News: Asterisk 1.2 Released! (Update)

We are proud to announce that Asterisk 1.2.0 has been released!

This release of Asterisk contains over 3,000 improvements on version 1.0, including hundreds of new features and applications.

It is available from the ftp.digium.com FTP servers, as well as the Digium CVS servers (under the 'v1-2-0' tag).

We want to extend our thanks to all the community members whose contributions have made this release possible; without their coding, support, testing and other involvement we would not have achieved this milestone!

Mark Spencer and Kevin P. Fleming

(Note: for a short time, a tarball of Asterisk 1.2.0 was present on the FTP servers with a build problem related to the chan_modem drivers; this has been corrected, and if you downloaded the new version before receiving this announcement, please re-download to ensure you have the proper version.)

Announce: Asterisk Realtime Voice Pitch Changer 0.2

Here is a quote from the site:

I just threw together a voice changer for Asterisk using the SoundTouch Library. Now we can all finally change the pitch of our voices and creep out friends/family. If you are not familiar with Asterisk or Linux then you might want to check out this page instead.

SoundTouch is unfortunately a C++ only library (HERESY!), so I had to hack the source to that as well... All that was really needed was to add class wrapper functions that 'export "C"' and create a .so file because it was generating a '.la' file or some esoteric C++ bullshit.


Click Here for more Information

Announce: DeStar 0.1 | Management Interface for the Asterisk PBX

Destar is a web-based interface to manage the Asterisk BPX.

It provides high-level abstraction of the Asterisk configuration.

Download the latest version: destar-0.1

Main features:

-Extensions management: SIP, IAX, Zap, and more.
-Auto-attendants support.
-Trunks management: SIP, IAX, Zap, ZapPRI, and more.
-Use of dialout patterns (i.e. local, national, mobile-phones).
-Asternic Flash Operator Panel integration.
-Call Detail Records search and graphical reports.
-Many application applets incluided: Voice Mail, Meeting Room, and more.

Click Here for more Information

Announce: Web-MeetMe v1.4.0

New Features-
- Weekly recurring meetings with the same room and pin numbers.
Any conflict in the conference number as identified before the conference is added, allowing the submitter to change the conference room number
- Database storage of MeetMe flags
This requires a db update to add the columns and a new version of app_cbmysql. In this release the flags are hard coded in the UI. I will be making a configuration option for the number of flags, and which flags are exposed. For now the Admin has only 'Announce name' as and option, and the User has 'Announce name' and 'Listen mode' options

This may be the last update to app_cbmysql. There is a recent bug opened on Mantis to make MeetMe use the Realtime architecture. If it is merged, I will port the scheduling functions to app_meetme.

The web interface will need minimal changes to be compatible, and I will continue to work on refining it.

[Location]
http://www.fitawi.com/Asterisk

[Files]
Web-MeetMe_v1.4.0.tgz (required)
app_cbmysql.c (required)
cbmysql.conf (required)
cb-extensions.conf (suggested)
README (suggested)

[Installation]
See the README

[Features]
1. Schedule new conferences
a. Control start and end times
b. Set conference pin #
i. Generate one if the requester leaves it blank
ii. Identify pin # conflicts (another conference with the same pin is scheduled at the same time)
c. Set Admin and User passwords
i. Generate a user password if an Admin pw is set but the User pw is blank
d. Weekly recurring conferences with the same settings
e. Select MeetMe flags per conference for Admins and Users
2. Email the details for a successfully scheduled conference
3. Separate views for Current, Past and Future conferences
4. Ability to modify the end time of a running conference
a. Can also reschedule a past or future conference.
5. Monitor realtime conference activity
a. Mute/Kick participants
6. Optional authentication
a. Currently Active Directory or LDAP based
b. Authentication is abstracted so unix/PAM/DB/RADIUS support could be easily added
7. Users can only monitor, update or delete their conferences
8. Verified administrators can monitor, update or delete any
conferences.
9. Updated to Asterisk 1.2.0-beta1
a. Changes to the Manager interface may have caused
support for 1.0.X to slip, I cannot test that)

***Developer help/guidence request***
The day/month/year code needs to be rewritten in javascript to allow the fields to dynamically update. Changing from a month that has 31 day to one with 30 should update the day field if it is set to 31. Similar logic is needed for dealing with February in leap/non-leap years.

This is well outside my experience and if anyone would care to contribute the code, I'd appreciate it. Or if someone can point out a way to do it in PHP, even better.

Thanks and enjoy,
Dan

Announce: New Asterisk WEB Interface ( astwebmgr )

Hello List!

I wrote something to allow me to easily interact/configure Asterisk thru a WEB interface. Over time I added several things to it. I thought 'you all' might get some use from it. I call it 'astwebmgr'.

You can get it here: http://www.micpc.com/astwebmgr

It is written in PHP (with a little JavaScript).

Functions are listed below:

HOME: Return to the Main Menu
AGI: AGI Documentation
CDR: List or Search Asterisk CDR records (CSV only, not SQL)
DB: Database Functions Add/Delete/Deltree/Get/Show
EDIT: Access various system and Asterisk configuration files [Edit/Delete]
FAX: Access/view FAX files
FW: Turn ON/OFF IPTABLES FireWall Rules for Asterisk functions
LOGS: List or Search System or Asterisk Log files
MAILBOX: Add or Delete a VoiceMail Mailbox
MANAGER: Interact with the Asterisk Manager
ORIGINATE: Create call files or create a call through the manager interface
PHPInfo: PHP Configuration Information
SOUND: Access/View Sound files
TC: Traffic Control functions
VOICEMAIL: View Voice MailBox and Listen via the WEB(uses the asterisk provided script) Information Information on how to obtain the latest version

earl

Announce: New astGUIclient/VICIDIAL version released 1.1.8

Matt Florell has posted details of the new release of the astGUIclient/VICIDIAL app.

Hello,

We've released another update to our Asterisk GUI Client suite: 1.1.8

http://astguiclient.sf.net/

The client suite runs on most modern web browsers on almost any GUI-capable operating system, and it includes the astGUIclient client-side web app which extends your phone's functionality and the VICIDIAL client-side web app auto-dialer. This package is free as in GPL.

(the suite is not an asterisk configuration tool)
This package is geared towards Asterisk installations with SIP,IAX or Zap phones and Zaptel, IAX or SIP trunks.

For this revision, we have added many call-recording features as well as very detailed call and activity logging within VICIDIAL. We have also made the suite more compliant with Asterisk 1.2 and have tested it with Asterisk versions through 1.2rc1

All client web-apps and administration pages are available in English and Spanish, with rough translations of French, German, Italian, Portuguese and Greek for the client web-apps only.

Check out the project blog for screenshots and more information:
http://astguiclient.blogspot.com

Let me know what you think.

Thanks,

MATT---

Announce: New revision of my MFC/R2 software available

Hi,

Users of my MFC/R2 software may be interested to know that new versions are available. These fix a bug where a timer was not always correctly cancelled. The result could be the locking up of a channel.

You can download the updates from: http://www.soft-switch.org

Regards,
Steve

Bugs: Asterisk vmail.cgi vulnerability

Matt Riddell of SineApps has posted details of the vulnerability. Good Job!

Assurance.com.au - Vulnerability Advisory
-----------------------------------------------
Release Date:
07-Nov-2005

Software:
Asterisk Web-VoiceMail (Comedian VoiceMail)
http://www.asterisk.org/

Asterisk is a complete PBX in software. It runs on Linux, BSD and MacOSX and provides all of the features you would expect from a PBX and more.
Asterisk does voice over IP in many protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware.

Versions affected:
Asterisk Versions <= 1.0.9
Asterisk Beta Versions <= 1.2.0-beta1
Asterisk @ Home Versions <= 1.5
Asterisk @ Home Beta Versions <= 2.0 Beta 4

Vulnerability discovered:

A vulnerability in the voicemail retrieval system allows an authenticated user to download any .wav/.WAV file from the system, including other users voicemail messages.

http://www.assurance.com.au/

Low - Insecure web-ui causes breach of privacy

Vulnerability information:

vmail.cgi doesn't clean a parameter passed by the web user which is later used to open a file and return a raw stream to the user. This allows any authenticated user of the voicemail system to listen to other peoples messages, or to open any file with the extension .wav/.WAV on the system.

Example

This will return:
/var/spool/asterisk/voicemail/default
/201/INBOX/msg0001.wav
when logged in as the 'extension 200' user.

Solution:
Asterisk has released patches for the vulnerabilities.
Ensure you are running Asterisk versions > 1.0.9 / 1.2.0-beta1
Ensure you are running Asterisk @ Home versions > 1.5 / 2.0 beta 4

References:
Assurance.com.au advisory
http://www.assurance.com.au/advisories/200511-asterisk.txt

Asterisk advisory note:
http://www.asterisk.org/changelog

Credit:
Adam Pointon of Assurance.com.au
http://www.assurance.com.au/

Disclosure timeline:
17-Oct-2005 - Discovered during a quick audit of the asterisk web ui
18-Oct-2005 - Email sent to support and the primary author
18-Oct-2005 - Immediate response received
31-Oct-2005 - Patched version committed to CVS
07-Nov-2005 - Advisory released

Queue Metrics: queue_log and mysql support

A new update has been posted to the List.

Hello List,
I'm glad to announce that we have released the first version of QueueMetrics that supports MySQL storage of queue_log data. It is still experimental, so if you run such a setup and would like to give it a try, you are welcome. The MySQL adapter should adapt to any existing table format, so you don't have to convert your existing data. See http://queuemetrics.loway.it/news.jsp
QueueMetrics is free for personal / SOHO usage.

Yours,
l.

Loway Research - Home of QueueMetrics
http://queuemetrics.loway.it

News: Asterisk 1.2.0-rc1 Released!

Kevin Flemming has finally dropped the Bombshell on the community. Ok time to get que for the FTP :-) Enjoy and make sure you email about any bugs you find.

The first release candidate of Asterisk 1.2.0 has been released! It is available from the FTP servers, as well as the Digium CVS servers (under the 'v1-2-0-rc1' tag).

Download Links:

Asterisk
FTP


This release includes a large number of improvements over beta2, including:

* Many bug fixes
* Documentation and sample configuration updates
* New 'stack' applications Gosub/Return/etc.

We ask all interested community members to download and install the release candidate (on a non-production server) and report their findings via our bug tracker at bugs.digium.com. Please be sure to read the UPGRADE.txt file in the distribution before upgrading your server, as there are a large number of changes that you will need to be aware of (some of them are not backwards compatible with the 1.0.x releases).

We want to extend our thanks to all the community members whose contributions have made this release possible; without their support, testing and other involvement we would not have reached this milestone so soon! I want to extend special thanks to Russell Bryant and BJ Weschke who put in many hours in the last two weeks doing 'janitorial' code updates that nobody else wanted to do. Thanks to you both!

Announce: New package posted to Sourceforge

Paul from the User List has post details about some addons for Amp users.


Post:

" just posted a few addons for the AMP users ...

These are several routines I found necessary for my system
1: Speed Dials revised my way (AMP front end into DB)
2: Intercom in business,
3: Group Paging in business,
4: Cisco phone display (XML) of internal directory list from AMP extensions DB.

Intercom & Paging is not AMP dependent - tested on Cisco phones.

http://sourceforge.net/projects/enhanceme/

Paul Norris
Silicon Valley Products"

News: Asterisk and Instant Messaging

The Asterisk community is now working on Instant Messaging, not being totally unaffected by the buzz about integration of voice and messaging in the market.

Asterisk 1.2 will have support for SIMPLE notifications of device presence. We will show if a phone is on a call, if it's ringing or if it's off line (not registered). We have no support for SIMPLE messaging outside of a call. Within a call, you can send text with sendtext() in the dial plan to SIP phones that supports it.

Click Here for More Informations

Info: Free Test Providers

Trixter from the User list has posted a link for some free providers to help with your voip testing.

Quote from site:

Broadvoice claims that talk is cheap as their service mark, however they still charge fees, sometimes in excess of their plans. Well talk is cheaper than you would think, its free. Not just computer to computer but via VoIP to the PSTN (phone network). Here is a list of various providers that are free, I do not have any ability to comment on the quality of the different providers, and that would only be relevant from my network to theirs, your network may be on a totally different place on the net, and so you may get better or worse performance than me anyway.

Click Here for the List

http://freevoip.gedameurope.com - emailed in from Matt from SineApps (Thanks!)


Note: It has been brought to my attention that the link has gone down. It was live when the article was posted. I will keep checking back to see the status. Please email me if you have a list of Free Providers for testing purposes.

News: Astlinux Development wiki goes online

A dev wiki for Astlinux has come alive. Thank you Kris.

Click Here: http://wikihost.org/wikis/astlinux/

Announce: New version (0.6) of Queue Statistics released

Zoa has posted details of the new version of Queue Stats.

Freely available for download at:
http://www.asteriskguru.com/tools/queue_stats.php

Changes since last version :

- Bugs removed (and new bugs introduced)
- pdf reporting.
- internationalisation (language files)
- works on both windows and linux

Currently only few language files are included, if you make your own, please consider sending it to us so that we can include you language too.

Older features include:

* complete overview of all incoming calls to your queue
* complete overview of all taken and lost calls
* graphical and table based representation of the quality of service provided to your clients
* overviews of calltime and holdtime
* selections can be made on
o any chosen period of time
o any queue
o agents
o date
o hour
o weekday
* it is blazing fast
* has some nice eyecandy
* and it's free!


In case of installation problems, please post them here :
http://www.asteriskguru.com/board/viewtopic.php?t=253


Zoa.