PT-2011-4013 · Digium · Asterisk Open Source

Published 2011-07-06 · Updated 2017-08-29 · CVE-2011-2666

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.4.x through 1.4.41.2 Asterisk Open Source versions 1.6.2.x through 1.6.2.18.2

Description The default configuration of the SIP channel driver in Asterisk Open Source does not enable the alwaysauthreject option. This allows remote attackers to enumerate account names by making a series of invalid SIP requests and observing the differences in the responses for different usernames.

Recommendations For Asterisk Open Source versions 1.4.x through 1.4.41.2, enable the alwaysauthreject option to prevent account name enumeration. For Asterisk Open Source versions 1.6.2.x through 1.6.2.18.2, enable the alwaysauthreject option to prevent account name enumeration.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2011-2666

Affected Products

Asterisk Open Source

References · 7

• https://osv.dev/vulnerability/CVE-2011-2666 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-2666 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2666 · Vendor Advisory
• http://downloads.asterisk.org/pub/security/AST-2011-011.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2666 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68472 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2666 · Note