PT-2011-5003 · Digium · Asterisk Open Source

Ben Williams · Publicado 2011-12-15 · Atualizado 2012-11-06 · CVE-2011-4597

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.4.x through 1.4.42 Asterisk Open Source versions 1.6.x through 1.6.2.20 Asterisk Open Source versions 1.8.x through 1.8.7.1

Description The issue affects the SIP over UDP implementation, allowing remote attackers to enumerate usernames by sending a series of requests. This is possible due to the different port numbers used for responses to invalid requests, depending on whether a SIP username exists.

Recommendations For Asterisk Open Source versions 1.4.x through 1.4.42, update to version 1.4.43 or later. For Asterisk Open Source versions 1.6.x through 1.6.2.20, update to version 1.6.2.21 or later. For Asterisk Open Source versions 1.8.x through 1.8.7.1, update to version 1.8.7.2 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2011-4597

DSA-2367-1

Produtos afetados

Asterisk Open Source

Referências · 13

• https://security-tracker.debian.org/tracker/CVE-2011-4597 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/12/09/4 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4597 · Aviso do Fabricante
• http://osvdb.org/77597 · Nota
• http://secunia.com/advisories/47273 · Nota
• http://debian.org/security/2011/dsa-2367 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-4597 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2011-12/0151.html · Nota
• http://downloads.asterisk.org/pub/security/AST-2011-013.html · Nota
• http://openwall.com/lists/oss-security/2011/12/09/3 · Nota
• http://lists.digium.com/pipermail/asterisk-dev/2011-November/052191.html · Nota
• https://osv.dev/vulnerability/CVE-2011-4597 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4597 · Nota