PT-2011-3922 · Digium · Asterisk Business Edition+1

Publicado 2011-07-06 · Atualizado 2011-09-07 · CVE-2011-2536

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.4.x through 1.4.41.1 Asterisk Open Source versions 1.6.2.x through 1.6.2.18.1 Asterisk Open Source versions 1.8.x through 1.8.4.3 Asterisk Business Edition C.3.x through C.3.7.2

Description The issue allows remote attackers to enumerate account names via a series of requests, as the SIP channel driver generates different responses for invalid SIP requests depending on whether the user account exists.

Recommendations For Asterisk Open Source versions 1.4.x through 1.4.41.1, update to version 1.4.41.2 or later. For Asterisk Open Source versions 1.6.2.x through 1.6.2.18.1, update to version 1.6.2.18.2 or later. For Asterisk Open Source versions 1.8.x through 1.8.4.3, update to version 1.8.4.4 or later. For Asterisk Business Edition C.3.x through C.3.7.2, update to version C.3.7.3 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2011-2536

DSA-2276-1

DSA-2276-2

Produtos afetados

Asterisk Business Edition

Asterisk Open Source

Referências · 8

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2536 · Nota
• http://securitytracker.com/id?1025734 · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-2536 · Aviso do Fabricante
• http://downloads.asterisk.org/pub/security/AST-2011-011.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2536 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-2536 · Nota de Segurança
• http://downloads.asterisk.org/pub/security/AST-2011-011-1.8.diff · Correção
• https://osv.dev/vulnerability/CVE-2011-2536 · Aviso do Fabricante