PT-2009-4268 · Sangoma · Freepbx

Published 2009-05-28 · Updated 2019-12-10 · CVE-2009-1803

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: FreePBX versions 2.4.x through 2.5.1 FreePBX version 2.6.x (pre-release)

Description: The issue allows remote attackers to enumerate valid usernames by generating different error messages for a failed login attempt depending on whether the user account exists.

Recommendations: For FreePBX versions 2.4.x through 2.5.1, consider modifying the login error messages to be generic and not indicative of whether the user account exists or not. For FreePBX version 2.6.x (pre-release), consider the same modification as above until a formal release with the fix is available. As a temporary workaround, consider restricting access to the login functionality to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2009-1803

Affected Products

Freepbx

References · 5

• http://secunia.com/advisories/34772 · Vendor Advisory
• http://securityfocus.com/bid/34857 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-1803 · Security Note
• http://osvdb.org/54263 · Note
• http://freepbx.org/trac/ticket/3660 · Note