Asterisk late last night announced two new releases of Asterisk. One of the bug fixes includes a fix for a remote crash vulnerability in the Skinny channel driver due to a Denial of Service type attach. This Denial of Service bug is part of Asterisk Project Security Advisory - ASA-2007-019.More about the new release according to Asterisk.org:
The Asterisk development team has released Asterisk versions 1.2.24 and 1.4.10.
Version 1.2.24 is the final 1.2 release that contains normal bug fixes. The 1.2 branch will only be maintained with security fix releases from now until it is completely deprecated.
Version 1.4.10 contains numerous bug fixes for things all over Asterisk, as well as a fix for a security issue. The security issue only affects users of chan_skinny and is documented in ASA-2007-019.
http://downloads.digium.com/pub/asa/ASA-2007-019.pdf
Another set of noteworthy changes in version 1.4.10 include many fixes for the IAX2 channel driver. Special recognition goes out to the developers over at Wimba (http://www.wimba.com/) for their dedication to tracking down numerous complicated issues in the 1.4 version of chan_iax2. Thank you very much Mihai, Steve, and Pete!
These releases are available for download from the following location:
