PT-2013-3628 · Digium · Asterisk Digiumphones+3
Walter Doekes
+1
·
Published
2013-03-29
·
Updated
2013-04-01
·
CVE-2013-2264
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Asterisk Open Source versions 1.8.x through 1.8.20.1
Asterisk Open Source versions 10.x through 10.12.1
Asterisk Open Source versions 11.x through 11.2.1
Certified Asterisk versions 1.8.15 through 1.8.15-cert1
Asterisk Business Edition (BE) versions C.3.x through C.3.8.0
Asterisk Digiumphones versions 10.x-digiumphones through 10.12.2-digiumphones
Description
The SIP channel driver in Asterisk exhibits different behavior for invalid INVITE, SUBSCRIBE, and REGISTER transactions depending on whether the user account exists. This allows remote attackers to enumerate account names by reading HTTP status codes, reading additional text in a 403 response, or observing whether certain retransmissions occur.
Recommendations
For Asterisk Open Source versions 1.8.x through 1.8.20.1, update to version 1.8.20.2 or later.
For Asterisk Open Source versions 10.x through 10.12.1, update to version 10.12.2 or later.
For Asterisk Open Source versions 11.x through 11.2.1, update to version 11.2.2 or later.
For Certified Asterisk versions 1.8.15 through 1.8.15-cert1, update to version 1.8.15-cert2 or later.
For Asterisk Business Edition (BE) versions C.3.x through C.3.8.0, update to version C.3.8.1 or later.
For Asterisk Digiumphones versions 10.x-digiumphones through 10.12.2-digiumphones, update to a version that includes the fix for this issue.
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Asterisk Business Edition
Asterisk Digiumphones
Asterisk Open Source
Certified Asterisk