Why VICIfast servers run Asterisk 22.5.1 with our own security patches

Every VICIdial server runs Asterisk underneath. It's the phone engine: it places the calls, carries the audio and hands answered calls to your agents. VICIfast servers run Asterisk 22, the long-term support line, and until this week they all ran version 22.5.1.

Asterisk kept fixing security bugs

Since 22.5.1, the Asterisk team has published 25 security advisories for the 22 line, fixed in versions 22.5.2 through 22.11. Most are in parts of Asterisk a VICIdial server never uses, like old phone protocols or chat. A few matter to everyone: a malformed SIP (Session Initiation Protocol) header that could crash Asterisk, bugs in the code behind browser phones, and gaps in Asterisk's built-in web server.

The usual answer is "upgrade". We tested that first.

Why we didn't just upgrade

Newer 22.x versions rewrote how Asterisk passes events to programs like VICIdial over the AMI (Asterisk Manager Interface). On our test servers that saves real CPU, about a quarter on the event side.

But on a busy dialer the faster event path changed something more important: what happens to answered calls. VICIdial moves every answered call to AMD (answering machine detection) with a quick redirect, and when a dialer is very busy some of those redirects arrive late. On 22.5.1 a late redirect usually means the call is lost. On the newer versions the call gets through, but late, so AMD hears "hello?" followed by silence and decides it's an answering machine. Fewer real people reached an agent, not more.

We explain this timing problem in our research report on what slows down a busy VICIdial server, and we'll publish the full version comparison once Asterisk 22.12 is final.

For a call center, the people who reach an agent are the whole point. So we kept 22.5.1.

What we did instead

We took the official 22.5.1 and applied every one of those 25 security fixes to it, unchanged except where 22.5.1's older code needed a small adjustment. The result calls itself 22.5.1-vf1. On calls it behaves exactly like 22.5.1, because none of the changes behind the AMD problem come with it. It just has the security holes closed.

flowchart LR
  A[Asterisk 22.5.1, official] --> B[+ 25 security fixes from 22.5.2 to 22.11]
  B --> C[- 12 modules VICIdial never uses]
  C --> D[Asterisk 22.5.1-vf1 on new VICIfast servers]

We also switched off 12 Asterisk modules VICIdial never uses. Asterisk loads everything it was built with, so these were running for no reason, and two of them were listening for network traffic: one for an old desk-phone protocol, one for a lookup protocol nobody uses with VICIdial. Code that isn't running can't be attacked. Everything VICIdial needs, including multi-server clusters, is untouched.

What this means for you

• New VICIfast servers get 22.5.1-vf1 automatically. There's nothing to do.
• Calls, AMD and agents work the same way they did on 22.5.1.
• Existing servers stay on 22.5.1 for now, while we run the new build on our own servers first.

To see which one your server runs, open the console from your dashboard and type asterisk -V. A new server answers Asterisk 22.5.1-vf1. If you run several servers, here's how to check the version across all of them.

If you're comparing hosts, it's worth asking which Asterisk version they run and when it last got security fixes. On VICIfast it's handled for you, on every plan: see plans and pricing.