Comments on: Another Asterisk Security Hole to Plug in TrixBox Systems (updated)

By: Joe

Joe — Fri, 04 May 2007 01:33:46 +0000

I used zaptel-1.2.17.1 and Ward’s instructions for upgrade with no problems whatsoever.

By: Costa

Costa — Wed, 02 May 2007 09:46:14 +0000

Digium is only hosting zaptel-1.2.17.1 now, NOT zaptel-1.2.17.
With that and comment #6 (Michael) I’m going to hold off due
to the phear phactor alone.

[WM: Yeah, it’s been a rough couple of weeks for the developers. Been there, done that.]

By: michael

michael — Sun, 29 Apr 2007 20:17:00 +0000

Beware, I’ve upgraded last weekend to zaptel-1.2.17.1, and the system totaly crashed with Kernel Panic. Even the Linux was stuck and I had to reinstall everything from scratch on a production sever. I use Trixbox 2.0 and Sangoma A200. FYI..

By: Ed Lally

Ed Lally — Fri, 27 Apr 2007 19:23:05 +0000

Ward,

Is there any particular reason not to update asterisk via yum? It’s installed on the Trixbox 1.2.3 systems by default, and a simple “yum -y update asterisk” took care of my upgrade rather nicely.

[WM: The yum option wasn’t available when the article was written.]

By: Dan

Dan — Thu, 26 Apr 2007 06:51:37 +0000

Some of these versions are already out of date. Is it safe to go with zaptel-1.2.17.1 and asterisk-addons-1.2.6?

[WM: Beats me, but there’s usually a very good reason for the new releases. So much for testing. Go for it! We’ve updated the article as well.]

By: Andrew

Andrew — Thu, 26 Apr 2007 06:34:14 +0000

First off, thanks for all the great help & tips – I have a working system despite being a complete newbie.

One of the pieces of advice you gave, I fully intended to follow – not rushing into upgrading, but of course I didn’t…

I was going to wait a few days before applying these patches, in case anything changed. The following two lines do not work:

wget http://ftp.digium.com/pub/telephony/zaptel/zaptel-1.2.16.tar.gz
wget http://ftp.digium.com/pub/telephony/asterisk/asterisk-addons-1.2.5.tar.gz

The current versions are now 1.2.17.1 & 1.2.6 respectively. I wasn’t sure whether to go for ‘bleeding edge’ or follow your instructions, I went with the latter and used:

wget http://ftp.digium.com/pub/telephony/zaptel/releases/zaptel-1.2.16.tar.gz
wget http://ftp.digium.com/pub/telephony/asterisk/releases/asterisk-addons-1.2.5.tar.gz

This appears to have worked for me, I now await your next telling me I should have gone with the other option!

Many thanks again.

[WM: Thanks for the heads up. Didn’t know we were going to have to update this article EACH DAY when we wrote it.]

By: cvander

cvander — Wed, 25 Apr 2007 17:03:32 +0000

It appears that zaptel-1.2.16 is no longer available from http://ftp.digium.com . In it’s place use zaptel-1.2.17.tar.gz and you will be fine.

By: Tom King

Tom King — Wed, 25 Apr 2007 15:49:41 +0000

Hi Ward

I have updated my script to include your new steps and revised the source code revision numbers.

http://www.script-trix.us/updatesource.htm

So far it seems to work just great. Thanks for all of your hard work.

Tom

[WM: Tom’s script will need a little updating for the new Zaptel and Addon modules which were released overnight. Tom has made this incredibly easy to fix. Just don’t forget to do it.]