Asterisk VoIP server user accounts enumeration

Different replies for non-exstant SIP account and invalid password...

Asterisk认证SIP响应用户名枚举漏洞

BUGTRAQ ID: 34353 CVECAN ID: CVE-2008-3903 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 如果启用了Digest认证的话，Asterisk PBX对登录期间所尝试的有效和无效SIP用户名会返回不同的响应，远程攻击者可以通过暴力猜测枚举出有效的用户名。 Asterisk Asterisk 1.6.0.x Asterisk Asterisk 1.4.x Asterisk Asterisk 1.2.x Asterisk Business Edition C.2.x.x Asterisk Business Edition...

SIP Username Enumerator (UDP)

Scan for numeric username/extensions using OPTIONS/REGISTER requests This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SIP Username Enumerator UDP', 'Description' = 'Scan for numeric...

CVE-2008-6575

Unspecified vulnerability in the SIP server in SIP Enablement Services SES in Avaya Communication Manager 3.1.x and 4.x allows remote authenticated users to cause a denial of service resource consumption via unknown vectors...

CVE-2008-6574

Unspecified vulnerability in SIP Enablement Services SES in Avaya Communication Manager 3.1.x and 4.x allows remote attackers to gain privileges and cause a denial of service via unknown vectors related to reuse of valid credentials...

Code injection

Unspecified vulnerability in SIP Enablement Services SES in Avaya Communication Manager 3.1.x and 4.x allows remote attackers to gain privileges and cause a denial of service via unknown vectors related to reuse of valid credentials...

Code injection

Unspecified vulnerability in the SIP server in SIP Enablement Services SES in Avaya Communication Manager 3.1.x and 4.x allows remote authenticated users to cause a denial of service resource consumption via unknown vectors...

CVE-2008-6573

Multiple SQL injection vulnerabilities in Avaya SIP Enablement Services SES in Avaya Avaya Communication Manager 3.x, 4.0, and 5.0 1 allow remote attackers to execute arbitrary SQL commands via unspecified vectors related to profiles in the SIP Personal Information Manager SPIM in the web...

Sql injection

Multiple SQL injection vulnerabilities in Avaya SIP Enablement Services SES in Avaya Avaya Communication Manager 3.x, 4.0, and 5.0 1 allow remote attackers to execute arbitrary SQL commands via unspecified vectors related to profiles in the SIP Personal Information Manager SPIM in the web...

CVE-2008-6575

Technical details about CVE-2008-6575 are not publicly provided in the connected documents. The materials only reiterate an unspecified denial-of-service against Avaya SES SIP server. Monitor for updates and new advisories to clarify impact and remediation.

CVE-2008-6573

Multiple SQL injection vulnerabilities in Avaya SIP Enablement Services SES in Avaya Avaya Communication Manager 3.x, 4.0, and 5.0 1 allow remote attackers to execute arbitrary SQL commands via unspecified vectors related to profiles in the SIP Personal Information Manager SPIM in the web...

CVE-2008-6575

Unspecified vulnerability in the SIP server in SIP Enablement Services SES in Avaya Communication Manager 3.1.x and 4.x allows remote authenticated users to cause a denial of service resource consumption via unknown vectors...

CVE-2008-6574

CVE-2008-6574 affects Avaya Communication Manager SIP Enablement Services (SES) on versions 3.1.x and 4.x. The vulnerability allows remote attackers to gain privileges and cause a denial of service through unspecified vectors related to reuse of valid credentials. The connected documents do not p...

CVE-2008-6574

Unspecified vulnerability in SIP Enablement Services SES in Avaya Communication Manager 3.1.x and 4.x allows remote attackers to gain privileges and cause a denial of service via unknown vectors related to reuse of valid credentials...

CVE-2008-6573

CVE-2008-6573 affects Avaya SIP Enablement Services (SES) embedded in Avaya Communication Manager 3.x, 4.0, and 5.0. The vulnerability is described as multiple SQL injection issues exploitable via the web-based SPIM profile management interface and via permissions for SPIM profiles, as well as th...

SIP Endpoint Scanner (UDP)

Scan for SIP devices using OPTIONS requests This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SIP Endpoint Scanner UDP', 'Description' = 'Scan for SIP devices using OPTIONS requests', 'Author' =...

CVE-2009-0636

Unspecified vulnerability in Cisco IOS 12.0 through 12.4, when SIP voice services are enabled, allows remote attackers to cause a denial of service device crash via a valid SIP message...

Code injection

Unspecified vulnerability in Cisco IOS 12.0 through 12.4, when SIP voice services are enabled, allows remote attackers to cause a denial of service device crash via a valid SIP message...

Authentication flaw

The 1 Cisco Unified Communications Manager Express; 2 SIP Gateway Signaling Support Over Transport Layer Security TLS Transport; 3 Secure Signaling and Media Encryption; 4 Blocks Extensible Exchange Protocol BEEP; 5 Network Admission Control HTTP Authentication Proxy; 6 Per-user URL Redirect for...

CVE-2009-0636

Unspecified vulnerability in Cisco IOS 12.0 through 12.4, when SIP voice services are enabled, allows remote attackers to cause a denial of service device crash via a valid SIP message...