"Vishing" advisory targets Asterisk

Even for those not able to apply the source patch, an effective configuration workaround is mentioned there.

Many of the less-maintained Asterisk systems have a configuration built with the FreePBX system. In the standard configuration of the FreePBX system the default context from the general section is sent to a context that hangs up immediately, and hence would not allow any relayed calls.

And there are other issues to worry about, as stated in the discussion that followed. For instance, there are now more and more remote VoIP extensions. Those normally authenticate by password (technically: a challenge-response protocol. At least in SIP. So passwords are not sent in the clear). Naturally some of them have weak passwords and attackers try to guess such passwords.