[7.880][BUG][OPEN] Maybe ATA responding to traffic outside of range

Hi,
last night I ran a security scan of my ASG.
Turned up some interesting results, but I don't get see some of them unless I pay money.

The one that does interest me and causes me some concern is SIP report.

I have SIP security enabled and sites that the ATAs can talk to as part of the setup.
The security scan site is not in the IP range allowed into or out of the ASG for VoIP traffic, so why was the security scan able to talk to and get one of my ATAs to respond to it. I know this limiting access used to work under previous versions.

Ian M

Parents

0 kbr over 15 years ago
Okay. Since the look at the scan didn't reveal enough helpful insight, let's go another route.

There's a file [FONT="Courier New"]/etc/modprobe.d/netfilter[/FONT] on the ASG, that contains something like this:

options ip_conntrack_sip sip_direct_signalling=0 sip_direct_media=0

Can you try setting sip_direct_signalling to 1, reboot, and then re-run that scan? There is a small chance that this setting narrows the window back to the expected and configured size.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 15 years ago in reply to kbr

Hi,
I don't want to make any changes or restart the ASG until someone has had a chance to review the current high http proxy usage.

Ian M
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 15 years ago in reply to RFCat_vk_01

Hi,
Changes made and new scan requested.

Ian M
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 15 years ago in reply to RFCat_vk_01

Hi,
the scan completed with less of the lower vulnerabilities and the SIP one did not show up in the don't worry category.
I now have 3 major vulnerabilities which is interesting considering I closed a couple of open points.
The scan report is available if you want to have a look at it.

I will have to wait for the review before deciding the next step.

Ian M
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 RFCat_vk_01 over 15 years ago in reply to RFCat_vk_01

Hi,
the scan completed with less of the lower vulnerabilities and the SIP one did not show up in the don't worry category.
I now have 3 major vulnerabilities which is interesting considering I closed a couple of open points.
The scan report is available if you want to have a look at it.

I will have to wait for the review before deciding the next step.

Ian M
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data