CVE-2011-4597

The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series ...

CVE-2011-4598

The handlerequestinfo function in channels/chansip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted sequence of SIP requests...

CVE-2011-4597

The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series ...

CVE-2011-4598

The handlerequestinfo function in channels/chansip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted sequence of SIP requests...

CVE-2011-4597

CVE-2011-4597 affects Asterisk Open Source SIP over UDP implementations in 1.4.x up to 1.4.43, 1.6.x up to 1.6.2.21, and 1.8.x up to 1.8.7.2. The vulnerability arises from using different port numbers for responses to invalid requests based on whether a SIP username exists, enabling remote attack...

CVE-2011-4598

CVE-2011-4598 affects Asterisk Open Source 1.6.2.x (before 1.6.2.21) and 1.8.x (before 1.8.7.2). The handle_request_info function in channels/chan_sip.c can trigger a NULL pointer dereference and daemon crash when automon is enabled, via a crafted sequence of SIP requests, leading to a denial of ...

Asterisk Multiple Vulnerabilities (AST-2011-013 / AST-2011-014)

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by the following vulnerabilities : - An issue in the SIP protocol can lead to the enumeration of endpoints with NAT settings different from the default. Note that this is an issu...

AST-2011-014: Remote crash possibility with SIP and the "automon" feature enabled

Asterisk Project Security Advisory - AST-2011-014 Product Asterisk Summary Remote crash possibility with SIP and the "automon" feature enabled Nature of Advisory Remote crash vulnerability in a feature that is disabled by default Susceptibility Remote unauthenticated sessions Severity Moderate...

AST-2011-013: Possible remote enumeration of SIP endpoints with differing NAT settings

Asterisk Project Security Advisory - AST-2011-013 Product Asterisk Summary Possible remote enumeration of SIP endpoints with differing NAT settings Nature of Advisory Unauthorized data disclosure Susceptibility Remote unauthenticated sessions Severity Minor Exploits Known Yes Reported On 2011-07-...

FreeBSD : asterisk -- Multiple Vulnerabilities (bb389137-21fb-11e1-89b4-001ec9578670)

Asterisk project reports : It is possible to enumerate SIP usernames when the general and user/peer NAT settings differ in whether to respond to the port a request is sent from or the port listed for responses in the Via header. When the 'automon' feature is enabled in features.conf, it is possib...

asterisk -- Multiple Vulnerabilities

Asterisk project reports: It is possible to enumerate SIP usernames when the general and user/peer NAT settings differ in whether to respond to the port a request is sent from or the port listed for responses in the Via header. When the "automon" feature is enabled in features.conf, it is possibl...

Asterisk SIP Channel Driver Uninitialized Variable Request Parsing DoS (AST-2011-012)

According to the version in its SIP banner, the version of Asterisk running on the remote host can be crashed remotely by an authenticated user when parsing an invalid SIP URI. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...

Asterisk Invalid INVITE / REGISTER SIP Request Username Enumeration (AST-2011-011)

According to the version in its SIP banner, the version of Asterisk running on the remote host allows a remote attacker to enumerate valid users by sending malformed SIP INVITE and REGISTER requests. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Fedora 15 : asterisk-1.8.7.1-1.fc15 (2011-14538)

The Asterisk Development Team has announced a security release for Asterisk= 1.8. The available security release is released as version 1.8.7.1. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases The release of Asterisk 1.8.7.1 resolv...

Fedora 16 : asterisk-1.8.7.1-1.fc16 (2011-14480)

The Asterisk Development Team has announced a security release for Asterisk= 1.8. The available security release is released as version 1.8.7.1. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases The release of Asterisk 1.8.7.1 resolv...

Fedora Update for asterisk FEDORA-2011-14538

Check for the Version of asterisk OpenVAS Vulnerability Test Fedora Update for asterisk FEDORA-2011-14538 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Fedora Update for asterisk FEDORA-2011-14538

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Asterisk Manager Login Utility

This module attempts to authenticate to an Asterisk Manager service. Please note that by default, Asterisk Call Management port 5038 only listens locally, but this can be manually configured in file /etc/asterisk/manager.conf by the admin on the victim machine. This module requires Metasploit:...

[SECURITY] Fedora 16 Update: asterisk-1.8.7.1-1.fc16

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...

[SECURITY] Fedora 15 Update: asterisk-1.8.7.1-1.fc15

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...