Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2011-4597

Overview

Vulnerability Score 5.0 5.0
CVE Id CVE-2011-4597
Last Modified 06 Nov 2012 12:04:03
Published 14 Dec 2011 10:57:34
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact NONE NONE
Availability Impact NONE NONE
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2011-4597

Summary

The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series of requests.

Vulnerable Systems

Application

  • Digium Asterisk 1.4.0

  • Digium Asterisk 1.4.1

  • Digium Asterisk 1.4.10

  • Digium Asterisk 1.4.10.1

  • Digium Asterisk 1.4.11

  • Digium Asterisk 1.4.12

  • Digium Asterisk 1.4.12.1

  • Digium Asterisk 1.4.13

  • Digium Asterisk 1.4.14

  • Digium Asterisk 1.4.15

  • Digium Asterisk 1.4.16

  • Digium Asterisk 1.4.16.1

  • Digium Asterisk 1.4.16.2

  • Digium Asterisk 1.4.17

  • Digium Asterisk 1.4.18

  • Digium Asterisk 1.4.19

  • Digium Asterisk 1.4.19.1

  • Digium Asterisk 1.4.19.2

  • Digium Asterisk 1.4.2

  • Digium Asterisk 1.4.20

  • Digium Asterisk 1.4.20.1

  • Digium Asterisk 1.4.21

  • Digium Asterisk 1.4.21.1

  • Digium Asterisk 1.4.21.2

  • Digium Asterisk 1.4.22

  • Digium Asterisk 1.4.22.1

  • Digium Asterisk 1.4.22.2

  • Digium Asterisk 1.4.23

  • Digium Asterisk 1.4.23.1

  • Digium Asterisk 1.4.23.2

  • Digium Asterisk 1.4.24

  • Digium Asterisk 1.4.24.1

  • Digium Asterisk 1.4.25

  • Digium Asterisk 1.4.25.1

  • Digium Asterisk 1.4.26

  • Digium Asterisk 1.4.26.1

  • Digium Asterisk 1.4.26.2

  • Digium Asterisk 1.4.26.3

  • Digium Asterisk 1.4.27

  • Digium Asterisk 1.4.27.1

  • Digium Asterisk 1.4.28

  • Digium Asterisk 1.4.29

  • Digium Asterisk 1.4.29.1

  • Digium Asterisk 1.4.3

  • Digium Asterisk 1.4.30

  • Digium Asterisk 1.4.31

  • Digium Asterisk 1.4.32

  • Digium Asterisk 1.4.33

  • Digium Asterisk 1.4.33.1

  • Digium Asterisk 1.4.34

  • Digium Asterisk 1.4.35

  • Digium Asterisk 1.4.36

  • Digium Asterisk 1.4.37

  • Digium Asterisk 1.4.38

  • Digium Asterisk 1.4.39

  • Digium Asterisk 1.4.39.1

  • Digium Asterisk 1.4.39.2

  • Digium Asterisk 1.4.4

  • Digium Asterisk 1.4.40

  • Digium Asterisk 1.4.40.1

  • Digium Asterisk 1.4.40.2

  • Digium Asterisk 1.4.41

  • Digium Asterisk 1.4.41.1

  • Digium Asterisk 1.4.41.2

  • Digium Asterisk 1.4.42

  • Digium Asterisk 1.4.5

  • Digium Asterisk 1.4.6

  • Digium Asterisk 1.4.7

  • Digium Asterisk 1.4.7.1

  • Digium Asterisk 1.4.8

  • Digium Asterisk 1.4.9

  • Digium Asterisk 1.6.2.0

  • Digium Asterisk 1.6.2.1

  • Digium Asterisk 1.6.2.15

  • Digium Asterisk 1.6.2.16

  • Digium Asterisk 1.6.2.16.1

  • Digium Asterisk 1.6.2.16.2

  • Digium Asterisk 1.6.2.17

  • Digium Asterisk 1.6.2.17.1

  • Digium Asterisk 1.6.2.17.2

  • Digium Asterisk 1.6.2.17.3

  • Digium Asterisk 1.6.2.18

  • Digium Asterisk 1.6.2.19

  • Digium Asterisk 1.6.2.2

  • Digium Asterisk 1.6.2.20

  • Digium Asterisk 1.6.2.21

  • Digium Asterisk 1.6.2.3

  • Digium Asterisk 1.6.2.4

  • Digium Asterisk 1.6.2.5

  • Digium Asterisk 1.6.2.6

  • Digium Asterisk 1.8.0

  • Digium Asterisk 1.8.1

  • Digium Asterisk 1.8.1.1

  • Digium Asterisk 1.8.1.2

  • Digium Asterisk 1.8.2

  • Digium Asterisk 1.8.2.1

  • Digium Asterisk 1.8.2.2

  • Digium Asterisk 1.8.2.3

  • Digium Asterisk 1.8.2.4

  • Digium Asterisk 1.8.3

  • Digium Asterisk 1.8.3.1

  • Digium Asterisk 1.8.3.2

  • Digium Asterisk 1.8.3.3

  • Digium Asterisk 1.8.4

  • Digium Asterisk 1.8.4.1

  • Digium Asterisk 1.8.4.2

  • Digium Asterisk 1.8.4.3

  • Digium Asterisk 1.8.4.4

  • Digium Asterisk 1.8.5

  • Digium Asterisk 1.8.5.0

  • Digium Asterisk 1.8.6.0

  • Digium Asterisk 1.8.7.0

  • Digium Asterisk 1.8.7.1


References

MLIST - [oss-security] 20111209 Re: CVE Request -- Asterisk -- AST-2011-013 and AST-2011-014

MLIST - [oss-security] 20111209 CVE Request -- Asterisk -- AST-2011-013 and AST-2011-014

CONFIRM - http://downloads.asterisk.org/pub/security/AST-2011-013.html

DEBIAN - DSA-2367

SECUNIA - 47273

OSVDB - 77597

MLIST - [asterisk-dev] 20111108 Summary: SIP, NAT, security concerns, oh my!

BUGTRAQ - 20111222 Exploit for Asterisk Security Advisory AST-2011-013


Last Updated: 27 May 2016 10:57:55