PT-2009-4268 · Sangoma · Freepbx

Publicado 2009-05-28 · Atualizado 2019-12-10 · CVE-2009-1803

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: FreePBX versions 2.4.x through 2.5.1 FreePBX version 2.6.x (pre-release)

Description: The issue allows remote attackers to enumerate valid usernames by generating different error messages for a failed login attempt depending on whether the user account exists.

Recommendations: For FreePBX versions 2.4.x through 2.5.1, consider modifying the login error messages to be generic and not indicative of whether the user account exists or not. For FreePBX version 2.6.x (pre-release), consider the same modification as above until a formal release with the fix is available. As a temporary workaround, consider restricting access to the login functionality to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2009-1803

Produtos afetados

Freepbx

Referências · 5

• http://osvdb.org/54263 · Nota
• http://secunia.com/advisories/34772 · Aviso do Fabricante
• http://securityfocus.com/bid/34857 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2009-1803 · Nota de Segurança
• http://freepbx.org/trac/ticket/3660 · Nota