Asterisk Authentication SIP Response Remote Information Disclosure Vulnerability
BID:34353
Info
Asterisk Authentication SIP Response Remote Information Disclosure Vulnerability
| Bugtraq ID: | 34353 |
| Class: | Design Error |
| CVE: |
CVE-2008-3903 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 02 2009 12:00AM |
| Updated: | Dec 15 2009 05:24PM |
| Credit: | Kerin Millar and Fergal Glynn |
| Vulnerable: |
Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Asterisk s800i Appliance 1.3 Asterisk Asterisk Business Edition C.2.3 .2 Asterisk Asterisk Business Edition C.2.3 Asterisk Asterisk Business Edition C.2.1.2.1 Asterisk Asterisk Business Edition C.1.8.1 Asterisk Asterisk Business Edition C.1.6.2 Asterisk Asterisk Business Edition C.1.6.1 Asterisk Asterisk Business Edition C.1.6 Asterisk Asterisk Business Edition C.1.10.4 Asterisk Asterisk Business Edition C.1.10.3 Asterisk Asterisk Business Edition C.1.0-beta8 Asterisk Asterisk Business Edition C.1.0-beta7 Asterisk Asterisk Business Edition C Asterisk Asterisk Business Edition B.2.5.6 Asterisk Asterisk Business Edition B.2.5.5 Asterisk Asterisk Business Edition B.2.5.4 Asterisk Asterisk Business Edition B.2.5.3 Asterisk Asterisk Business Edition B.2.5.2 Asterisk Asterisk Business Edition B.2.5.1 Asterisk Asterisk Business Edition B.2.5 Asterisk Asterisk Business Edition B.2.3.6 Asterisk Asterisk Business Edition B.2.3.5 Asterisk Asterisk Business Edition B.2.3.4 Asterisk Asterisk Business Edition B.2.3.3 Asterisk Asterisk Business Edition B.2.3.2 Asterisk Asterisk Business Edition B.2.3.1 Asterisk Asterisk Business Edition B.2.2.1 Asterisk Asterisk Business Edition B.2.2.1 Asterisk Asterisk Business Edition B.2.2.0 Asterisk Asterisk Business Edition B.2.2.0 Asterisk Asterisk Business Edition B.1.3.3 Asterisk Asterisk Business Edition B.1.3.2 Asterisk Asterisk Business Edition B Asterisk Asterisk Business Edition A Asterisk Asterisk 1.6.1 0-rc2 Asterisk Asterisk 1.6.1 0-rc1 Asterisk Asterisk 1.6 beta6 Asterisk Asterisk 1.6 6 Asterisk Asterisk 1.4.24 Asterisk Asterisk 1.4.23 .2 Asterisk Asterisk 1.4.23 .1 Asterisk Asterisk 1.4.23 Asterisk Asterisk 1.4.22 Asterisk Asterisk 1.4.19 .1 Asterisk Asterisk 1.4.19 -rc3 Asterisk Asterisk 1.4.19 Asterisk Asterisk 1.4.18 Asterisk Asterisk 1.4.17 Asterisk Asterisk 1.4.16 Asterisk Asterisk 1.4.15 Asterisk Asterisk 1.4.14 Asterisk Asterisk 1.4.13 Asterisk Asterisk 1.4.12 Asterisk Asterisk 1.4.11 Asterisk Asterisk 1.4.10 Asterisk Asterisk 1.4.9 Asterisk Asterisk 1.4.8 Asterisk Asterisk 1.4.7 Asterisk Asterisk 1.4.6 Asterisk Asterisk 1.4.5 Asterisk Asterisk 1.4.4 Asterisk Asterisk 1.4.3 Asterisk Asterisk 1.4.2 Asterisk Asterisk 1.4.1 Asterisk Asterisk 1.2.31 Asterisk Asterisk 1.2.30 Asterisk Asterisk 1.2.29 Asterisk Asterisk 1.2.28 Asterisk Asterisk 1.2.27 Asterisk Asterisk 1.2.27 Asterisk Asterisk 1.2.26 Asterisk Asterisk 1.2.25 Asterisk Asterisk 1.2.24 Asterisk Asterisk 1.2.23 Asterisk Asterisk 1.2.22 Asterisk Asterisk 1.2.21 Asterisk Asterisk 1.2.19 Asterisk Asterisk 1.2.18 Asterisk Asterisk 1.2.17 Asterisk Asterisk 1.2.16 Asterisk Asterisk 1.2.15 Asterisk Asterisk 1.2.14 Asterisk Asterisk 1.2.13 Asterisk Asterisk 1.2.11 Asterisk Asterisk 1.2.11 Asterisk Asterisk 1.2.10 Asterisk Asterisk 1.2.9 Asterisk Asterisk 1.2.8 Asterisk Asterisk 1.2.7 Asterisk Asterisk 1.2.6 Asterisk Asterisk 1.2.5 Asterisk Asterisk 1.2 .0-beta2 Asterisk Asterisk 1.2 .0-beta1 Asterisk Asterisk 1.6.0.3 Asterisk Asterisk 1.6 Asterisk Asterisk 1.4.22.1 Asterisk Asterisk 1.4.21.2 Asterisk Asterisk 1.4.21.2 Asterisk Asterisk 1.4.18.1 Asterisk Asterisk 1.4 revision 95946 Asterisk Asterisk 1.4 Beta Asterisk Asterisk 1.2.30.4 Asterisk Asterisk 1.2.30.3 Asterisk Asterisk 0 |
| Not Vulnerable: |
Asterisk s800i Appliance 1.3 .2 Asterisk Asterisk Business Edition C.2.3.3 Asterisk Asterisk Business Edition C.1.10.5 Asterisk Asterisk Business Edition B.2.5.8 Asterisk Asterisk 1.6 .8 Asterisk Asterisk 1.4.24 .1 Asterisk Asterisk 1.2.32 |
Discussion
Asterisk Authentication SIP Response Remote Information Disclosure Vulnerability
Asterisk is prone to an information-disclosure vulnerability because it doesn't provide safe responses to failed authentication attempts.
Attackers can exploit this issue to discover whether specific usernames exist. Information harvested may aid in launching further attacks.
Asterisk is prone to an information-disclosure vulnerability because it doesn't provide safe responses to failed authentication attempts.
Attackers can exploit this issue to discover whether specific usernames exist. Information harvested may aid in launching further attacks.
Exploit / POC
Asterisk Authentication SIP Response Remote Information Disclosure Vulnerability
Attackers can use readily available utilities to exploit this issue.
Attackers can use readily available utilities to exploit this issue.
Solution / Fix
Asterisk Authentication SIP Response Remote Information Disclosure Vulnerability
Solution:
The vendor has released an advisory and updates. Please see the references for more information.
Debian Linux 5.0 ia-64
Debian Linux 5.0 alpha
Debian Linux 5.0 mipsel
Debian Linux 5.0 armel
Debian Linux 5.0
Debian Linux 5.0 mips
Debian Linux 5.0 sparc
Debian Linux 5.0 ia-32
Debian Linux 5.0 s/390
Solution:
The vendor has released an advisory and updates. Please see the references for more information.
Debian Linux 5.0 ia-64
-
Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-dbg_1.4.21.2~dfsg-3+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dbg_1 .4.21.2~dfsg-3+lenny1_ia64.deb -
Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-h323_1.4.21.2~dfsg-3+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.4.21.2~dfsg-3+lenny1_ia64.deb -
Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk_1.4.21.2~dfsg-3+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.4.2 1.2~dfsg-3+lenny1_ia64.deb
Debian Linux 5.0 alpha
-
Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-dbg_1.4.21.2~dfsg-3+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dbg_1 .4.21.2~dfsg-3+lenny1_alpha.deb -
Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-h323_1.4.21.2~dfsg-3+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.4.21.2~dfsg-3+lenny1_alpha.deb -
Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk_1.4.21.2~dfsg-3+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.4.2 1.2~dfsg-3+lenny1_alpha.deb
Debian Linux 5.0 mipsel
-
Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb
Debian Linux 5.0 armel
-
Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-dbg_1.4.21.2~dfsg-3+lenny1_armel.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dbg_1 .4.21.2~dfsg-3+lenny1_armel.deb -
Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-h323_1.4.21.2~dfsg-3+lenny1_armel.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.4.21.2~dfsg-3+lenny1_armel.deb -
Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk_1.4.21.2~dfsg-3+lenny1_armel.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.4.2 1.2~dfsg-3+lenny1_armel.deb
Debian Linux 5.0
-
Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb
Debian Linux 5.0 mips
-
Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-dbg_1.4.21.2~dfsg-3+lenny1_mips.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dbg_1 .4.21.2~dfsg-3+lenny1_mips.deb -
Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-h323_1.4.21.2~dfsg-3+lenny1_mips.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.4.21.2~dfsg-3+lenny1_mips.deb -
Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk_1.4.21.2~dfsg-3+lenny1_mips.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.4.2 1.2~dfsg-3+lenny1_mips.deb
Debian Linux 5.0 sparc
-
Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-dbg_1.4.21.2~dfsg-3+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dbg_1 .4.21.2~dfsg-3+lenny1_sparc.deb -
Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-h323_1.4.21.2~dfsg-3+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.4.21.2~dfsg-3+lenny1_sparc.deb -
Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk_1.4.21.2~dfsg-3+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.4.2 1.2~dfsg-3+lenny1_sparc.deb
Debian Linux 5.0 ia-32
-
Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-dbg_1.4.21.2~dfsg-3+lenny1_i386.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dbg_1 .4.21.2~dfsg-3+lenny1_i386.deb -
Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-h323_1.4.21.2~dfsg-3+lenny1_i386.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.4.21.2~dfsg-3+lenny1_i386.deb -
Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk_1.4.21.2~dfsg-3+lenny1_i386.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.4.2 1.2~dfsg-3+lenny1_i386.deb
Debian Linux 5.0 s/390
-
Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb -
Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb
References
Asterisk Authentication SIP Response Remote Information Disclosure Vulnerability
References:
References:
- Asterisk Homepage (Asterisk)
- AST-2009-003: SIP responses expose valid usernames ("Asterisk Security Team"
- AST-2009-003: SIP responses expose valid usernames (Asterisk)