Asterisk IAX2 Authentication Response Remote Information Disclosure Vulnerability

Bugtraq ID:	33174
Class:	Design Error
CVE:	CVE-2009-0041
Remote:	Yes
Local:	No
Published:	Jan 08 2009 12:00AM
Updated:	Apr 13 2015 10:22PM
Credit:	http://www.unprotectedhex.com
Vulnerable:	Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Asterisk s800i Appliance 1.2.0.1 Asterisk Asterisk Business Edition C.1.8.1 Asterisk Asterisk Business Edition C.1.6.2 Asterisk Asterisk Business Edition C.1.6.1 Asterisk Asterisk Business Edition C.1.6 Asterisk Asterisk Business Edition C.1.10.3 Asterisk Asterisk Business Edition C.1.0-beta8 Asterisk Asterisk Business Edition C.1.0-beta7 Asterisk Asterisk Business Edition B.2.5.6 Asterisk Asterisk Business Edition B.2.5.5 Asterisk Asterisk Business Edition B.2.5.4 Asterisk Asterisk Business Edition B.2.5.3 Asterisk Asterisk Business Edition B.2.5.2 Asterisk Asterisk Business Edition B.2.5.1 Asterisk Asterisk Business Edition B.2.3.6 Asterisk Asterisk Business Edition B.2.3.5 Asterisk Asterisk Business Edition B.2.3.4 Asterisk Asterisk Business Edition B.2.3.3 Asterisk Asterisk Business Edition B.2.3.2 Asterisk Asterisk Business Edition B.2.3.1 Asterisk Asterisk Business Edition B.2.2.1 Asterisk Asterisk Business Edition B.2.2.0 Asterisk Asterisk Business Edition B.1.3.3 Asterisk Asterisk Business Edition B.1.3.2 Asterisk Asterisk Business Edition A Asterisk Asterisk 1.6 beta6 Asterisk Asterisk 1.4.19 .1 Asterisk Asterisk 1.4.19 -rc3 Asterisk Asterisk 1.4.19 Asterisk Asterisk 1.4.18 Asterisk Asterisk 1.4.17 Asterisk Asterisk 1.4.16 Asterisk Asterisk 1.4.15 Asterisk Asterisk 1.4.14 Asterisk Asterisk 1.4.13 Asterisk Asterisk 1.4.12 Asterisk Asterisk 1.4.11 Asterisk Asterisk 1.4.10 Asterisk Asterisk 1.4.9 Asterisk Asterisk 1.4.8 Asterisk Asterisk 1.4.7 Asterisk Asterisk 1.4.6 Asterisk Asterisk 1.4.5 Asterisk Asterisk 1.4.4 Asterisk Asterisk 1.4.3 Asterisk Asterisk 1.4.2 Asterisk Asterisk 1.4.1 Asterisk Asterisk 1.2.30 Asterisk Asterisk 1.2.29 Asterisk Asterisk 1.2.28 Asterisk Asterisk 1.2.27 Asterisk Asterisk 1.2.26 Asterisk Asterisk 1.2.25 Asterisk Asterisk 1.2.24 Asterisk Asterisk 1.2.23 Asterisk Asterisk 1.2.22 Asterisk Asterisk 1.2.21 Asterisk Asterisk 1.2.19 Asterisk Asterisk 1.2.18 Asterisk Asterisk 1.2.17 Asterisk Asterisk 1.2.16 Asterisk Asterisk 1.2.15 Asterisk Asterisk 1.2.14 Asterisk Asterisk 1.2.13 Asterisk Asterisk 1.2.11 Asterisk Asterisk 1.2.10 Asterisk Asterisk 1.2.9 Asterisk Asterisk 1.2.8 Asterisk Asterisk 1.2.7 Asterisk Asterisk 1.2.6 Asterisk Asterisk 1.2.5 Asterisk Asterisk 1.2 .0-beta2 Asterisk Asterisk 1.2 .0-beta1 Asterisk Asterisk 1.6 Asterisk Asterisk 1.4.21.2 Asterisk Asterisk 1.4.18.1 Asterisk Asterisk 1.4 revision 95946 Asterisk Asterisk 1.4 Beta Asterisk Asterisk 1.2.30.4 Asterisk Asterisk 1.2.30.3 Asterisk Asterisk 0
Not Vulnerable:	Asterisk s800i Appliance 1.3 Asterisk Asterisk Business Edition C.2.1.2.1 Asterisk Asterisk Business Edition C.1.10.4 Asterisk Asterisk Business Edition B.2.5 Asterisk Asterisk 1.2.31 Asterisk Asterisk 1.6.0.3 Asterisk Asterisk 1.4.22.1

Asterisk IAX2 Authentication Response Remote Information Disclosure Vulnerability

Asterisk is prone to an information-disclosure vulnerability because it doesn't provide safe responses to failed authentication attempts.

Attackers can exploit this issue to discover whether specific usernames exist. Information harvested may aid in launching further attacks.

Asterisk IAX2 Authentication Response Remote Information Disclosure Vulnerability

Attackers can use readily available utilities to exploit this issue.

Asterisk IAX2 Authentication Response Remote Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.


Asterisk Asterisk 1.4 Beta

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.6

• Asterisk AST-2009-001-1.6.0.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.6.0.diff

Asterisk Asterisk 1.2.30.3

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.30.4

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.4 revision 95946

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.18.1

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.21.2

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.2 .0-beta1

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2 .0-beta2

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.10

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.11

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.13

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.14

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.15

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.17

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.18

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.19

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.22

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.23

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.24

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.25

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.27

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.28

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.29

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.30

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.5

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.6

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.7

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.8

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.2.9

• Asterisk AST-2009-001-1.2.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.2.diff

Asterisk Asterisk 1.4.10

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.11

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.12

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.13

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.14

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.15

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.16

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.17

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.18

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.19

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.19 -rc3

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.19 .1

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.2

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.4

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.5

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.6

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.7

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.8

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk Asterisk 1.4.9

• Asterisk AST-2009-001-1.4.diff
  http://downloads.digium.com/pub/security/AST-2009-001-1.4.diff

Asterisk IAX2 Authentication Response Remote Information Disclosure Vulnerability

References:

• Asterisk Homepage (Asterisk)
  
• AST-2009-001: Information leak in IAX2 authentication ("Asterisk Security Team" )
  
• AST-2009-001 Information leak in IAX2 authentication (Asterisk)