AST-2011-011: Possible enumeration of SIP users due to differing authentication responses

🗓️ 04 Jul 2011 00:00:00Reported by SecurityvulnsType

Possible enumeration of SIP users due to differing authentication responses. Asterisk may respond differently to SIP requests from an invalid SIP user than it does to a user configured on the system, even when the alwaysauthreject option is set in the configuration. This can leak information about what SIP users are valid on the Asterisk system. Respond to SIP requests from invalid and valid SIP users in the same way. Asterisk 1.4 and 1.6.2 do not respond identically by default due to backward-compatibility reasons, and must have alwaysauthreject=yes set in sip.conf. Asterisk 1.8 defaults to alwaysauthreject=yes. IT IS ABSOLUTELY IMPERATIVE that users of Asterisk 1.4 and 1.6.2 set alwaysauthreject=yes in the general section of sip.conf

Reporter	Title	Published	Views	Family All 28
FreeBSD	Asterisk -- multiple vulnerabilities	24 Jun 201100:00	–	freebsd
Tenable Nessus	Asterisk Invalid INVITE / REGISTER SIP Request Username Enumeration (AST-2011-011)	22 Nov 201100:00	–	nessus
Tenable Nessus	FreeBSD : Asterisk -- multiple vulnerabilities (40544e8c-9f7b-11e0-9bec-6c626dd55a41)	27 Jun 201100:00	–	nessus
Tenable Nessus	GLSA-201110-21 : Asterisk: Multiple vulnerabilities	25 Oct 201100:00	–	nessus
CVE	CVE-2011-2536	6 Jul 201119:00	–	cve
Cvelist	CVE-2011-2536	6 Jul 201119:00	–	cvelist
Debian CVE	CVE-2011-2536	6 Jul 201119:00	–	debiancve
EUVD	EUVD-2011-2519	7 Oct 202500:30	–	euvd
Gentoo Linux	Asterisk: Multiple vulnerabilities	24 Oct 201100:00	–	gentoo
Mend	CVE-2011-2536	6 Jul 201119:00	–	mend

04 Jul 2011 00:00Current

6Medium risk

Vulners AI Score6

EPSS0.01945