CVE-2009-0041

IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and C.2.x.x before C.2.1.2.1; and s800i 1.2.x before 1.3.0 responds differently to a failed login attempt depending on...

CVE-2009-0041: Exposure of Sensitive Information to an Unauthorized Actor

IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and C.2.x.x before C.2.1.2.1; and s800i 1.2.x before 1.3.0 responds differently to a failed login attempt depending on...

Asterisk IAX2认证响应信息泄露漏洞

BUGTRAQ ID: 33174 CVECAN ID: CVE-2009-0041 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 Asterisk IAX2在认证期间对用户不存在的情况和错误口令的情况提供了不同的响应，这允许攻击者通过扫描主机确定特定的用户。 Asterisk Asterisk 1.6.x Asterisk Asterisk 1.4.x Asterisk Asterisk 1.2.x Asterisk Business Edition C.2.x.x Asterisk Business Edition C.1.x.x Asterisk...

AST-2009-001: Information leak in IAX2 authentication

Asterisk Project Security Advisory - AST-2009-001 +------------------------------------------------------------------------+ | Product | Asterisk | |----------------------+-------------------------------------------------| | Summary | Information leak in IAX2 authentication |...

Asterisk user account enumeration

Different replies for invalid username and password in IAX2 authentication...

CVE-2008-5558: Improper Authentication

Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service crash via authentication attempts involving 1 an unknown user or 2 a user using hostname matching...

Asterisk voice server DoS

Crash on IAX2 processing...

AST-2008-012: Remote crash vulnerability in IAX2

Asterisk Project Security Advisory - AST-2008-012 +------------------------------------------------------------------------+ | Product | Asterisk | |----------------------+-------------------------------------------------| | Summary | Remote crash vulnerability in IAX2 |...

iax2-version NSE Script

Detects the UDP IAX2 service. The script sends an Inter-Asterisk eXchange IAX Revision 2 Control Frame POKE request and checks for a proper response. This protocol is used to enable VoIP connections between servers as well as client-server communication. Example Usage nmap -sU -sV -p 4569 Script...

Asterisk IAX2固件升级报文放大远程拒绝服务漏洞

BUGTRAQ ID: 30350 CVECAN ID: CVE-2008-3264 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 远程用户可以向Asterisk服务器请求发送部分的固件镜像，但固件下载协议没有初始化握手，可能伪造源地址。此外，对固件文件的IAX2 FWDOWNL请求可能仅为40字节，但生成1040字节的响应。如果向多个不同的Asterisk服务器提交了请求的话，就可以用大量固件报文对用户站点执行flood攻击。 Asterisk Asterisk 1.4.x Asterisk Asterisk 1.2.x Asterisk Asterisk...

Asterisk IAX2 (IAX) POKE Request Saturation Resource Exhaustion Remote DoS

The version of Asterisk running on the remote host consumes an IAX2 call number while waiting for an ACK packet in response to a PONG packet. By flooding the affected service with POKE requests, an unauthenticated, remote attacker can leverage this issue to exhaust all available call numbers and...

CVE-2008-3264

The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers t...

Server side request forgery (ssrf)

The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers t...

CVE-2008-3264

The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers t...

CVE-2008-3264

CVE-2008-3264 describes a DoS via the IAX2 FWDOWNL (firmware download) path in Asterisk and related packages. Affected: Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer...

CVE-2008-3264

The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers t...

CVE-2008-3264

The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers t...

AST-2008-010: Asterisk IAX 'POKE' resource exhaustion

Asterisk Project Security Advisory - AST-2008-010 +------------------------------------------------------------------------+ | Product | Asterisk | |----------------------+-------------------------------------------------| | Summary | Asterisk IAX 'POKE' resource exhaustion |...

CVE-2008-3264: Improper Authentication

The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers t...

Asterisk IAX2 FWDOWNL Request Spoofing Remote DoS

The firmware download protocol implemented in the version of Asterisk running on the remote host does not initiate a handshake. By spoofing an IAX2 FWDOWNL request, an unauthenticated, remote attacker may be able to leverage this issue to flood a third-party host with unwanted firmware packets fr...