Asterisk 1.8.x - SIP INVITE Request User Enumeration

source: https://www.securityfocus.com/bid/47676/info Asterisk is prone to a user-enumeration weakness. An attacker may leverage this issue to harvest valid usernames, which may aid in brute-force attacks. This issue affects Asterisks 1.8. The following request is available: INVITE sip:192.168.2.1...

Cisco Unified Communications Manager multiple security vulnerabilities

DoS via SIP, directory traversal, SQL injection...

Asterisk 1.8.x SIP User Enumeration

Asterisk, sip response permit username identification through use INVITE Author: francesco.tornieri "At" verona-wireless.net Summary: Sip responses permit user identification Release Date: 01/05/2011 Criticality level: Low Impact: Information leak Software: Asterisk 1.8.x tested 1.8.3.2...

Vulnerabilities in Cisco's Unified Communications Manager

Cisco published an advisory report yesterday detailing multiple vulnerabilities in there Unified Communications Manager. There are three denial of service vulnerabilities that affect session initiation protocol services, two SQL injection vulnerabilities, and a directory transversal vulnerability...

AST-2011-005: File Descriptor Resource Exhaustion

Asterisk Project Security Advisory - AST-2011-005 Product Asterisk Summary File Descriptor Resource Exhaustion Nature of Advisory Denial of Service Susceptibility Remote Unauthenticated TCP Based Sessions TCP SIP, Skinny, Asterisk Manager Interface, and HTTP sessions Severity Moderate Exploits...

Snom IP Phone Web Interface Multiple Vulnerabilities

Exploit for hardware platform in category web applications / / / / / // | / // \ | / / / / / /// / / / / / / / // / / / |/ / // / , / / // / / / / / //// //|///||/,/ / /// Live by the byte |// Members: Pr0T3cT10n -=M.o.B.=- TheLeader Sro Debug Contact: email protected...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified Communications Manager

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified Communications Manager Document ID: 112878 Advisory ID: cisco-sa-20110427-cucm Revision 1.0 For Public Release 2011 April 27 1600 UTC GMT...

Snom IP Phone Web Interface XSS / Disclosure

/ / / / / // | / // \ | / / / / / /// / / / / / / / // / / / |/ / // / , / / // / / / / / //// //|///||/,/ / /// Live by the byte |// Members: Pr0T3cT10n -=M.o.B.=- TheLeader Sro Debug Contact: [email protected] ----------------------------------- Snom IP Phone is vulnerable for a xss...

Snom IP Phone Web Interface 8 - Multiple Vulnerabilities

Snom IP Phone Web Interface 8 - Multiple Vulnerabilities / / / / / // | / // \ | / / / / / /// / / / / / / / // / / / |/ / // / , / / // / / / / / //// //|///||/,/ / /// Live by the byte |// Members: Pr0T3cT10n -=M.o.B.=- TheLeader Sro Debug Contact: [email protected]...

Asterisk Multiple Vulnerabilities (AST-2011-005 / AST-2011-006)

According to the version in its SIP banner, the version of Asterisk running on the remote host may be affected by multiple denial of service vulnerabilities : - On systems that have the Asterisk Manager interface, Skinny, SIP over TCP, or the built-in HTTP server enabled, it is possible for an...

FreeBSD : Asterisk -- multiple vulnerabilities (3c7d565a-6c64-11e0-813a-6c626dd55a41)

The Asterisk Development Team reports : It is possible for a user of the Asterisk Manager Interface to bypass a security check and execute shell commands when they should not have that ability. Sending the 'Async' header with the 'Application' header during an Originate action, allows authenticat...

SuSE 11.1 Security Update : dhcpcd (SAT Patch Number 4389)

A rogue DHCP server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the DHCP client needs to sanitize the host name offered by the server. CVE-2011-0996 Note this update is...

Hydra v6.2 with a password bruteforcing mode, xmpp and irc modules, MD5/SHA1/ Support !

Hydra v6.2 with a password bruteforcing mode, xmpp and irc modules, MD5/SHA1/ Support ! A very fast network logon cracker which support many different services. Have a look at the feature sets and services coverage page - including a speed comparison against ncrack and medusa! CHANGELOG for 6.2...

IBM WebSphere Application Server Multiple Vulnerabilities (Mar 2011)

IBM WebSphere Application Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

IBM WebSphere Application Server 7.0 < Fix Pack 15 Multiple Vulnerabilities

IBM WebSphere Application Server 7.0 before Fix Pack 15 appears to be running on the remote host. As such, it is reportedly affected by the following vulnerabilities : - A double free error in BBOOORBR control block could trigger a denial of service condition. PM17170 - A cross-site scripting...

Debian Security Advisory DSA 2171-1 (asterisk)

The remote host is missing an update to asterisk announced via advisory DSA 2171-1. OpenVAS Vulnerability Test $Id: deb21711.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2171-1 asterisk Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

Debian: Security Advisory (DSA-2171-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2011-1316

The Session Initiation Protocol SIP Proxy in the HTTP Transport component in IBM WebSphere Application Server WAS before 7.0.0.15 allows remote attackers to cause a denial of service worker thread exhaustion and UDP messaging outage by sending many UDP messages...

Session fixation

The Session Initiation Protocol SIP Proxy in the HTTP Transport component in IBM WebSphere Application Server WAS before 7.0.0.15 allows remote attackers to cause a denial of service worker thread exhaustion and UDP messaging outage by sending many UDP messages...

CVE-2011-1316

The Session Initiation Protocol SIP Proxy in the HTTP Transport component in IBM WebSphere Application Server WAS before 7.0.0.15 allows remote attackers to cause a denial of service worker thread exhaustion and UDP messaging outage by sending many UDP messages...