Asterisk Project Security Advisory – A missing ACL check for handling SIP INVITEs allows a device to make calls on networks intended to be prohibited as defined by the “deny” and “permit” lines in sip.conf. The ACL check for handling SIP registrations was not affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/82218/AST-2009-007.txt
Source: https://packetstormsecurity.com/files/82218/Asterisk-Project-Security-Advisory-AST-2009-007.html