Asterisk Project Security Advisory - AST-2009-008
±-----------------------------------------------------------------------+
| Product | Asterisk |
|----------------------±------------------------------------------------|
| Summary | SIP responses expose valid usernames |
|----------------------±------------------------------------------------|
| Nature of Advisory | Information leak |
|----------------------±------------------------------------------------|
| Susceptibility | Remote Unauthenticated Sessions |
|----------------------±------------------------------------------------|
| Severity | Minor |
|----------------------±------------------------------------------------|
| Exploits Known | No |
|----------------------±------------------------------------------------|
| Reported On | October 26, 2009 |
|----------------------±------------------------------------------------|
| Reported By | Patrik Karlsson <patrik AT cqure DOT net> |
|----------------------±------------------------------------------------|
| Posted On | November 4, 2009 |
|----------------------±------------------------------------------------|
| Last Updated On | November 4, 2009 |
|----------------------±------------------------------------------------|
| Advisory Contact | Joshua Colp <jcolp AT digium DOT com> |
|----------------------±------------------------------------------------|
| CVE Name | |
±-----------------------------------------------------------------------+
±-----------------------------------------------------------------------+
| Description | It is possible to determine if a peer with a specific |
| | name is configured in Asterisk by sending a specially |
| | crafted REGISTER message twice. The username that is to |
| | be checked is put in the user portion of the URI in the |
| | To header. A bogus non-matching value is put into the |
| | username portion of the Digest in the Authorization |
| | header. If the peer does exist the second REGISTER will |
| | receive a response of "403 Authentication user name does |
| | not match account name". If the peer does not exist the |
| | response will be "404 Not Found" if alwaysauthreject is |
| | disabled and "401 Unauthorized" if alwaysauthreject is |
| | enabled. |
±-----------------------------------------------------------------------+
±-----------------------------------------------------------------------+
| Resolution | Upgrade to one of the versions below, or apply one of the |
| | patches specified in the Patches section. |
±-----------------------------------------------------------------------+
±-----------------------------------------------------------------------+
Affected Versions |
---|
Product |
----------------------------±--------±-------------------------------- |
Asterisk Open Source |
----------------------------±--------±-------------------------------- |
Asterisk Open Source |
----------------------------±--------±-------------------------------- |
Asterisk Open Source |
----------------------------±--------±-------------------------------- |
Asterisk Open Source |
----------------------------±--------±-------------------------------- |
Asterisk Addons |
----------------------------±--------±-------------------------------- |
Asterisk Addons |
----------------------------±--------±-------------------------------- |
Asterisk Addons |
----------------------------±--------±-------------------------------- |
Asterisk Business Edition |
----------------------------±--------±-------------------------------- |
Asterisk Business Edition |
----------------------------±--------±-------------------------------- |
Asterisk Business Edition |
----------------------------±--------±-------------------------------- |
AsteriskNOW |
----------------------------±--------±-------------------------------- |
s800i (Asterisk Appliance) |
±-----------------------------------------------------------------------+ |
±-----------------------------------------------------------------------+
Corrected In |
---|
Product |
---------------------------------------------±------------------------- |
Asterisk Open Source |
---------------------------------------------±------------------------- |
Asterisk Open Source |
---------------------------------------------±------------------------- |
Asterisk Open Source |
---------------------------------------------±------------------------- |
Asterisk Open Source |
---------------------------------------------±------------------------- |
Asterisk Business Edition |
---------------------------------------------±------------------------- |
Asterisk Business Edition |
---------------------------------------------±------------------------- |
Asterisk Business Edition |
---------------------------------------------±------------------------- |
S800i (Asterisk Appliance) |
±-----------------------------------------------------------------------+ |
±-----------------------------------------------------------------------+
Patches |
---|
SVN URL |
---------------------------------------------------------------±------- |
http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt |
---------------------------------------------------------------±------- |
http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt |
---------------------------------------------------------------±------- |
http://downloads.digium.com/pub/asa/AST-2009-008-1.6.0.diff.txt |
---------------------------------------------------------------±------- |
http://downloads.digium.com/pub/asa/AST-2009-008-1.6.1.diff.txt |
±-----------------------------------------------------------------------+ |
±-----------------------------------------------------------------------+
| Links | |
±-----------------------------------------------------------------------+
±-----------------------------------------------------------------------+
| Asterisk Project Security Advisories are posted at |
| http://www.asterisk.org/security |
| |
| This document may be superseded by later versions; if so, the latest |
| version will be posted at |
| http://downloads.digium.com/pub/security/AST-2009-008.pdf and |
| http://downloads.digium.com/pub/security/AST-2009-008.html |
±-----------------------------------------------------------------------+
±-----------------------------------------------------------------------+
Revision History |
---|
Date |
-----------------------±------------------±--------------------------- |
November 4, 2009 |
±-----------------------------------------------------------------------+ |
Asterisk Project Security Advisory - AST-2009-008
Copyright (c) 2009 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.