MD5 Authentication Bug in Asterisk
Asterisk-Java with Asterisk 1.6
The good news is: Asterisk-Java seems to work quite well with the latest development version of Asterisk.
One issue came up with a discussion on igniterealtime.org concerning Asterisk-IM though. Asterisk-IM had problems authenticating to the latest development version of Asterisk. As it turned out the reason for this was a bug in Asterisk introduced a few months ago:
When using challenge/reponse authentication with AMI the "Login" action uses the secret supplied with the "Login" action instead of the one from manager.conf to calculate the MD5 hash.
This has two effects:
- Login with "AuthType: MD5" and "Key:" but without a "Secret:" always fails
- Anybody who knows a valid username can login without knowing the secret configured in manager.conf
As Asterisk-Java uses MD5 based challenge/response authentication by default there are probably other users out there that are affected by the problem.
The solution is easy: Just upgrade to the latest revision from trunk. Tilghman just commited a fix with r98536.