Asterisk SIP Response Username Enumeration Remote Information Disclosure Vulnerability

Bugtraq ID:	36924
Class:	Design Error
CVE:	CVE-2009-3727
Remote:	Yes
Local:	No
Published:	Nov 04 2009 12:00AM
Updated:	Jun 04 2010 07:30PM
Credit:	Patrik Karlsson
Vulnerable:	Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Asterisk s800i Appliance 1.3 .2 Asterisk s800i Appliance 1.3 Asterisk s800i Appliance 1.1 .3 Asterisk s800i Appliance 1.1 .2 Asterisk s800i Appliance 1.1 .0 Asterisk s800i Appliance 1.0.3 Asterisk s800i Appliance 1.0.2 Asterisk s800i Appliance 1.0.1 Asterisk s800i Appliance 1.0 Asterisk s800i Appliance 1.3.0.3 Asterisk s800i Appliance 1.2.0.1 Asterisk AsteriskNow 1.0.3 Asterisk AsteriskNow 1.0.2 Asterisk AsteriskNow pre-release Asterisk AsteriskNow Beta 7 Asterisk AsteriskNow Beta 6 Asterisk AsteriskNow Beta 5 Asterisk AsteriskNow 1.0 Asterisk Asterisk Business Edition C.3.1.0 Asterisk Asterisk Business Edition C.3.1 1 Asterisk Asterisk Business Edition C.2.4.3 Asterisk Asterisk Business Edition C.2.4.2 Asterisk Asterisk Business Edition C.2.3.3 Asterisk Asterisk Business Edition C.2.3 .2 Asterisk Asterisk Business Edition C.2.3 Asterisk Asterisk Business Edition C.2.1.2.1 Asterisk Asterisk Business Edition C.1.8.1 Asterisk Asterisk Business Edition C.1.6.2 Asterisk Asterisk Business Edition C.1.6.1 Asterisk Asterisk Business Edition C.1.6 Asterisk Asterisk Business Edition C.1.10.5 Asterisk Asterisk Business Edition C.1.10.4 Asterisk Asterisk Business Edition C.1.10.3 Asterisk Asterisk Business Edition C.1.0-beta8 Asterisk Asterisk Business Edition C.1.0-beta7 Asterisk Asterisk Business Edition C Asterisk Asterisk Business Edition B.2.5.9 Asterisk Asterisk Business Edition B.2.5.8 Asterisk Asterisk Business Edition B.2.5.6 Asterisk Asterisk Business Edition B.2.5.5 Asterisk Asterisk Business Edition B.2.5.4 Asterisk Asterisk Business Edition B.2.5.3 Asterisk Asterisk Business Edition B.2.5.2 Asterisk Asterisk Business Edition B.2.5.10 Asterisk Asterisk Business Edition B.2.5.1 Asterisk Asterisk Business Edition B.2.5 Asterisk Asterisk Business Edition B.2.3.6 Asterisk Asterisk Business Edition B.2.3.5 Asterisk Asterisk Business Edition B.2.3.4 Asterisk Asterisk Business Edition B.2.3.3 Asterisk Asterisk Business Edition B.2.3.2 Asterisk Asterisk Business Edition B.2.3.1 Asterisk Asterisk Business Edition B.2.2.1 Asterisk Asterisk Business Edition B.2.2.0 Asterisk Asterisk Business Edition B.1.3.3 Asterisk Asterisk Business Edition B.1.3.2 Asterisk Asterisk Business Edition B Asterisk Asterisk Business Edition A Asterisk Asterisk 1.6.1 0-rc2 Asterisk Asterisk 1.6.1 0-rc1 Asterisk Asterisk 1.6.1 .6 Asterisk Asterisk 1.6.1 .5 Asterisk Asterisk 1.6.1 Asterisk Asterisk 1.6 beta6 Asterisk Asterisk 1.6 6 Asterisk Asterisk 1.6 .8 Asterisk Asterisk 1.4.26 Asterisk Asterisk 1.4.24 .1 Asterisk Asterisk 1.4.24 Asterisk Asterisk 1.4.23 .2 Asterisk Asterisk 1.4.23 .1 Asterisk Asterisk 1.4.23 Asterisk Asterisk 1.4.22 Asterisk Asterisk 1.4.19 .1 Asterisk Asterisk 1.4.19 -rc3 Asterisk Asterisk 1.4.19 Asterisk Asterisk 1.4.18 Asterisk Asterisk 1.4.17 Asterisk Asterisk 1.4.16 Asterisk Asterisk 1.4.15 Asterisk Asterisk 1.4.14 Asterisk Asterisk 1.4.13 Asterisk Asterisk 1.4.12 Asterisk Asterisk 1.4.11 Asterisk Asterisk 1.4.10 Asterisk Asterisk 1.4.9 Asterisk Asterisk 1.4.8 Asterisk Asterisk 1.4.7 Asterisk Asterisk 1.4.6 Asterisk Asterisk 1.4.5 Asterisk Asterisk 1.4.4 Asterisk Asterisk 1.4.3 Asterisk Asterisk 1.4.2 Asterisk Asterisk 1.4.1 Asterisk Asterisk 1.3.34 Asterisk Asterisk 1.2.34 Asterisk Asterisk 1.2.33 Asterisk Asterisk 1.2.32 Asterisk Asterisk 1.2.31 Asterisk Asterisk 1.2.30 Asterisk Asterisk 1.2.29 Asterisk Asterisk 1.2.28 Asterisk Asterisk 1.2.27 Asterisk Asterisk 1.2.26 Asterisk Asterisk 1.2.25 Asterisk Asterisk 1.2.24 Asterisk Asterisk 1.2.23 Asterisk Asterisk 1.2.22 Asterisk Asterisk 1.2.21 Asterisk Asterisk 1.2.19 Asterisk Asterisk 1.2.18 Asterisk Asterisk 1.2.17 Asterisk Asterisk 1.2.16 Asterisk Asterisk 1.2.15 Asterisk Asterisk 1.2.14 Asterisk Asterisk 1.2.13 Asterisk Asterisk 1.2.11 Asterisk Asterisk 1.2.10 Asterisk Asterisk 1.2.9 Asterisk Asterisk 1.2.8 Asterisk Asterisk 1.2.7 Asterisk Asterisk 1.2.6 Asterisk Asterisk 1.2.5 Asterisk Asterisk 1.2 .0-beta2 Asterisk Asterisk 1.2 .0-beta1 Asterisk Asterisk 1.0.12 Asterisk Asterisk 1.0.11 Asterisk Asterisk 1.0.10 Asterisk Asterisk 1.0.9 Asterisk Asterisk 1.0.8 Asterisk Asterisk 1.0.7 Asterisk Asterisk 1.0.6 Asterisk Asterisk 1.0 Asterisk Asterisk 0.9 .0 Asterisk Asterisk 0.7.2 Asterisk Asterisk 0.7.1 Asterisk Asterisk 0.7 .0 Asterisk Asterisk 0.4.1 Asterisk Asterisk 0.4 Asterisk Asterisk 0.3 Asterisk Asterisk 0.2 Asterisk Asterisk 0.1.11 Asterisk Asterisk 0.1.9 -1 Asterisk Asterisk 0.1.9 Asterisk Asterisk 0.1.8 Asterisk Asterisk 0.1.7 Asterisk Asterisk 1.6.1.8 Asterisk Asterisk 1.6.1.7 Asterisk Asterisk 1.6.0.3 Asterisk Asterisk 1.6.0.15 Asterisk Asterisk 1.6.0.14 Asterisk Asterisk 1.6 Asterisk Asterisk 1.4.26.2 Asterisk Asterisk 1.4.26.1 Asterisk Asterisk 1.4.22.1 Asterisk Asterisk 1.4.21.2 Asterisk Asterisk 1.4.18.1 Asterisk Asterisk 1.4 revision 95946 Asterisk Asterisk 1.4 Beta Asterisk Asterisk 1.2.30.4 Asterisk Asterisk 1.2.30.3 Asterisk Asterisk 1.0.3.4 Asterisk Asterisk 0
Not Vulnerable:	Asterisk s800i Appliance 1.3 5 Asterisk Asterisk Business Edition C.3.2 2 Asterisk Asterisk Business Edition C.2.4 5 Asterisk Asterisk Business Edition B.2.5 12 Asterisk Asterisk 1.6.1 .9 Asterisk Asterisk 1.6 .17 Asterisk Asterisk 1.4.26 .3 Asterisk Asterisk 1.2.35

Asterisk SIP Response Username Enumeration Remote Information Disclosure Vulnerability

Asterisk is prone to an information-disclosure vulnerability because it doesn't provide safe responses to failed authentication attempts.

Attackers can exploit this issue to discover whether specific usernames exist. Information harvested may aid in launching further attacks.

Asterisk SIP Response Username Enumeration Remote Information Disclosure Vulnerability

Attackers can use readily available utilities to exploit this issue.

Asterisk SIP Response Username Enumeration Remote Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.


Asterisk Asterisk 1.6.0.3

• Asterisk AST-2009-008-1.6.0.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.6.0.diff.txt

Asterisk Asterisk 1.6

• Asterisk AST-2009-008-1.6.0.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.6.0.diff.txt

Debian Linux 5.0 alpha

• Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-dbg_1.4.21.2~dfsg-3+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dbg_1 .4.21.2~dfsg-3+lenny1_alpha.deb


• Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-h323_1.4.21.2~dfsg-3+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.4.21.2~dfsg-3+lenny1_alpha.deb


• Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk_1.4.21.2~dfsg-3+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.4.2 1.2~dfsg-3+lenny1_alpha.deb

Asterisk Asterisk 1.2.30.3

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Debian Linux 5.0 armel

• Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-dbg_1.4.21.2~dfsg-3+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dbg_1 .4.21.2~dfsg-3+lenny1_armel.deb


• Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-h323_1.4.21.2~dfsg-3+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.4.21.2~dfsg-3+lenny1_armel.deb


• Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk_1.4.21.2~dfsg-3+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.4.2 1.2~dfsg-3+lenny1_armel.deb

Debian Linux 5.0 mips

• Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-dbg_1.4.21.2~dfsg-3+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dbg_1 .4.21.2~dfsg-3+lenny1_mips.deb


• Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-h323_1.4.21.2~dfsg-3+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.4.21.2~dfsg-3+lenny1_mips.deb


• Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk_1.4.21.2~dfsg-3+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.4.2 1.2~dfsg-3+lenny1_mips.deb

Debian Linux 5.0 sparc

• Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-dbg_1.4.21.2~dfsg-3+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dbg_1 .4.21.2~dfsg-3+lenny1_sparc.deb


• Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-h323_1.4.21.2~dfsg-3+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.4.21.2~dfsg-3+lenny1_sparc.deb


• Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk_1.4.21.2~dfsg-3+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.4.2 1.2~dfsg-3+lenny1_sparc.deb

Asterisk Asterisk 1.2.30.4

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.4.18.1

• Asterisk AST-2009-008-1.4.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt

Debian Linux 5.0 s/390

• Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb

Asterisk Asterisk 1.4.21.2

• Asterisk AST-2009-008-1.4.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt

Debian Linux 5.0 hppa

• Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-dbg_1.4.21.2~dfsg-3+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dbg_1 .4.21.2~dfsg-3+lenny1_hppa.deb


• Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-h323_1.4.21.2~dfsg-3+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-h323_ 1.4.21.2~dfsg-3+lenny1_hppa.deb


• Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk_1.4.21.2~dfsg-3+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk_1.4.2 1.2~dfsg-3+lenny1_hppa.deb

Debian Linux 5.0 m68k

• Debian asterisk-config_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-confi g_1.4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-dev_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-dev_1 .4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-doc_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-doc_1 .4.21.2~dfsg-3+lenny1_all.deb


• Debian asterisk-sounds-main_1.4.21.2~dfsg-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/a/asterisk/asterisk-sound s-main_1.4.21.2~dfsg-3+lenny1_all.deb

Asterisk Asterisk 1.2 .0-beta1

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.10

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.11

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.13

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.14

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.15

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.18

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.22

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.25

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.28

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.29

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.31

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.32

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.34

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.5

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.6

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.7

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.2.8

• Asterisk AST-2009-008-1.2.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt

Asterisk Asterisk 1.4.13

• Asterisk AST-2009-008-1.4.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt

Asterisk Asterisk 1.4.15

• Asterisk AST-2009-008-1.4.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt

Asterisk Asterisk 1.4.16

• Asterisk AST-2009-008-1.4.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt

Asterisk Asterisk 1.4.17

• Asterisk AST-2009-008-1.4.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt

Asterisk Asterisk 1.4.18

• Asterisk AST-2009-008-1.4.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt

Asterisk Asterisk 1.4.19 -rc3

• Asterisk AST-2009-008-1.4.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt

Asterisk Asterisk 1.4.22

• Asterisk AST-2009-008-1.4.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt

Asterisk Asterisk 1.4.24 .1

• Asterisk AST-2009-008-1.4.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt

Asterisk Asterisk 1.4.24

• Asterisk AST-2009-008-1.4.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt

Asterisk Asterisk 1.4.4

• Asterisk AST-2009-008-1.4.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt

Asterisk Asterisk 1.4.5

• Asterisk AST-2009-008-1.4.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt

Asterisk Asterisk 1.4.9

• Asterisk AST-2009-008-1.4.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt

Asterisk Asterisk 1.6 .8

• Asterisk AST-2009-008-1.6.0.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.6.0.diff.txt

Asterisk Asterisk 1.6.1 0-rc1

• Asterisk AST-2009-008-1.6.1.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.6.1.diff.txt

Asterisk Asterisk 1.6.1 .6

• Asterisk AST-2009-008-1.6.1.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.6.1.diff.txt

Asterisk Asterisk 1.6.1

• Asterisk AST-2009-008-1.6.1.diff
  http://downloads.digium.com/pub/asa/AST-2009-008-1.6.1.diff.txt

Asterisk SIP Response Username Enumeration Remote Information Disclosure Vulnerability

References:

• Asterisk Homepage (Asterisk)
  
• AST-2009-008: SIP responses expose valid usernames ("Asterisk Security Team" )
  
• AST-2009-008 SIP responses expose valid usernames (Asterisk)