Asterisk SIP Authentication Request User Enumeration Weakness
BID:48485
Info
Asterisk SIP Authentication Request User Enumeration Weakness
| Bugtraq ID: | 48485 |
| Class: | Design Error |
| CVE: |
CVE-2011-2536 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 28 2011 12:00AM |
| Updated: | Oct 24 2011 08:22PM |
| Credit: | The vendor has reported this issue. |
| Vulnerable: |
Gentoo Linux Asterisk Asterisk Business Edition C.3.6.4 Asterisk Asterisk Business Edition C.3.6.3 Asterisk Asterisk Business Edition C.3.6.2 Asterisk Asterisk Business Edition C.3.3.2 Asterisk Asterisk Business Edition C.3.2 3 Asterisk Asterisk Business Edition C.3.2 2 Asterisk Asterisk Business Edition C.3.1.0 Asterisk Asterisk Business Edition C.3.1 1 Asterisk Asterisk 1.8.4 2 Asterisk Asterisk 1.8.4 1 Asterisk Asterisk 1.8.2 4 Asterisk Asterisk 1.8.1 Asterisk Asterisk 1.8 Asterisk Asterisk 1.6.2 16.2 Asterisk Asterisk 1.6.2 .5 Asterisk Asterisk 1.6.2 Asterisk Asterisk 1.4.39 2 Asterisk Asterisk 1.4.27 1 Asterisk Asterisk 1.4.26 .3 Asterisk Asterisk 1.4.26 Asterisk Asterisk 1.4.24 .1 Asterisk Asterisk 1.4.24 Asterisk Asterisk 1.4.23 .1 Asterisk Asterisk 1.4.23 Asterisk Asterisk 1.4.22 Asterisk Asterisk 1.4.19 .1 Asterisk Asterisk 1.4.19 Asterisk Asterisk 1.4.18 Asterisk Asterisk 1.4.17 Asterisk Asterisk 1.4.16 Asterisk Asterisk 1.4.15 Asterisk Asterisk 1.4.14 Asterisk Asterisk 1.4.13 Asterisk Asterisk 1.4.12 Asterisk Asterisk 1.4.11 Asterisk Asterisk 1.4.10 Asterisk Asterisk 1.4.4 Asterisk Asterisk 1.4.3 Asterisk Asterisk 1.4.2 Asterisk Asterisk 1.4.1 Asterisk Asterisk 1.8.4.3 Asterisk Asterisk 1.8.3.3 Asterisk Asterisk 1.8.3.1 Asterisk Asterisk 1.8.2.1 Asterisk Asterisk 1.8.1.2 Asterisk Asterisk 1.8 Asterisk Asterisk 1.6.2.2 Asterisk Asterisk 1.6.2.18.1 Asterisk Asterisk 1.6.2.17.3 Asterisk Asterisk 1.6.2.17.1 Asterisk Asterisk 1.6.2.16.1 Asterisk Asterisk 1.6.2.15.1 Asterisk Asterisk 1.4.41.1 Asterisk Asterisk 1.4.39.1 Asterisk Asterisk 1.4.38.1 Asterisk Asterisk 1.4.26.2 Asterisk Asterisk 1.4.26.1 Asterisk Asterisk 1.4.22.1 Asterisk Asterisk 1.4.21.2 Asterisk Asterisk 1.4.18.1 Asterisk Asterisk 1.4.40.1 |
| Not Vulnerable: |
Asterisk Asterisk Business Edition C.3.7.3 Asterisk Asterisk 1.8.4.4 Asterisk Asterisk 1.6.2.18.2 Asterisk Asterisk 1.4.41.2 |
Discussion
Asterisk SIP Authentication Request User Enumeration Weakness
Asterisk is prone to a user-enumeration weakness.
An attacker may leverage this issue to harvest valid usernames, which may aid in brute-force attacks.
This issue is fixed in the following versions:
Asterisk 1.4.41.2, 1.6.2.18.2, and 1.8.4.4
Asterisk Business Edition C.3.7.3
Asterisk is prone to a user-enumeration weakness.
An attacker may leverage this issue to harvest valid usernames, which may aid in brute-force attacks.
This issue is fixed in the following versions:
Asterisk 1.4.41.2, 1.6.2.18.2, and 1.8.4.4
Asterisk Business Edition C.3.7.3
Exploit / POC
Asterisk SIP Authentication Request User Enumeration Weakness
An attacker can exploit this issue using readily available tools.
An attacker can exploit this issue using readily available tools.
Solution / Fix
Asterisk SIP Authentication Request User Enumeration Weakness
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Asterisk SIP Authentication Request User Enumeration Weakness
References:
References:
- Asterisk Homepage (Asterisk)
- Possible enumeration of SIP users due to differing authentication responses (Asterisk)