Asterisk Open Source 1.2.x before 1.2.26 and 1.4.x before 1.4.16, and Business Edition B.x.x before B.2.3.6 and C.x.x before C.1.0-beta8, when using database-based registrations ("realtime") and host-based authentication, does not check the IP address when the username is correct and there is no password, which allows remote attackers to bypass authentication using a valid username.

The remote host is affected by the vulnerability described in GLSA-200804-13 (Asterisk: Multiple vulnerabilities)

    Asterisk upstream developers reported multiple vulnerabilities:
    The Call Detail Record Postgres logging engine (cdr_pgsql)     does not correctly escape the ANI and DNIS arguments before using them     in SQL statements (CVE-2007-6170).
    When using database-based     registrations ('realtime') and host-based authentication, Asterisk does     not check the IP address when the username is correct and there is no     password provided (CVE-2007-6430).
    The SIP channel driver does     not correctly determine if authentication is required     (CVE-2008-1332).
  Impact :

    Remote authenticated attackers could send specially crafted data to     Asterisk to execute arbitrary SQL commands and compromise the     administrative database. Remote unauthenticated attackers could bypass     authentication using a valid username to hijack other user's sessions,     and establish sessions on the SIP channel without authentication.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in Asterisk, a free software PBX and telephony toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6430     Tilghman Lesher discovered that database-based     registrations are insufficiently validated. This only     affects setups, which are configured to run without a     password and only host-based authentication.

  - CVE-2008-1332     Jason Parker discovered that insufficient validation of     From: headers inside the SIP channel driver may lead to     authentication bypass and the potential external     initiation of calls.

  - CVE-2008-1333     This update also fixes a format string vulnerability,     which can only be triggered through configuration files     under control of the local administrator. In later     releases of Asterisk this issue is remotely exploitable     and tracked as CVE-2008-1333.

The status of the old stable distribution (sarge) is currently being investigated. If affected, an update will be released through security.debian.org.

Attackers could bypass host based authentication by using a valid username (CVE-2007-6430)

Attackers could inject SQL commands under certain circumstances if 'cdr_pgsql' was used (CVE-2007-6170)

ID	Name	Product	Family	Severity
31960	GLSA-200804-13 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
31631	Debian DSA-1525-1 : asterisk - several vulnerabilities	Nessus	Debian Local Security Checks	high
31390	openSUSE 10 Security Update : asterisk (asterisk-5062)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2007-6430

critical

Tenable Plugins

high

high

medium