Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, 1.6.0.x before 1.6.0.17, and 1.6.1.x before 1.6.1.9; Business Edition A.x.x, B.x.x before B.2.5.12, C.2.x.x before C.2.4.5, and C.3.x.x before C.3.2.2; AsteriskNOW 1.5; and s800i 1.3.x before 1.3.0.5 generate different error messages depending on whether a SIP username is valid, which allows remote attackers to enumerate valid usernames via multiple crafted REGISTER messages with inconsistent usernames in the URI in the To header and the Digest in the Authorization header.

The remote host is affected by the vulnerability described in GLSA-201006-20 (Asterisk: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in Asterisk:
    Nick Baggott reported that Asterisk does not properly process     overly long ASCII strings in various packets (CVE-2009-2726).
    Noam Rathaus and Blake Cornell reported a flaw in the IAX2 protocol     implementation (CVE-2009-2346).
    amorsen reported an input     processing error in the RTP protocol implementation     (CVE-2009-4055).
    Patrik Karlsson reported an information     disclosure flaw related to the REGISTER message (CVE-2009-3727).
    A vulnerability was found in the bundled Prototype JavaScript     library, related to AJAX calls (CVE-2008-7220).
  Impact :

    A remote attacker could exploit these vulnerabilities by sending a     specially crafted package, possibly causing a Denial of Service     condition, or resulting in information disclosure.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in asterisk, an Open Source PBX and telephony toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0041     It is possible to determine valid login names via     probing, due to the IAX2 response from asterisk     (AST-2009-001).

  - CVE-2008-3903     It is possible to determine a valid SIP username, when     Digest authentication and authalwaysreject are enabled     (AST-2009-003).

  - CVE-2009-3727     It is possible to determine a valid SIP username via     multiple crafted REGISTER messages (AST-2009-008).

  - CVE-2008-7220 CVE-2007-2383     It was discovered that asterisk contains an obsolete     copy of the Prototype JavaScript framework, which is     vulnerable to several security issues. This copy is     unused and now removed from asterisk (AST-2009-009).

  - CVE-2009-4055     It was discovered that it is possible to perform a     denial of service attack via RTP comfort noise payload     with a long data length (AST-2009-010).

The current version in oldstable is not supported by upstream anymore and is affected by several security issues. Backporting fixes for these and any future issues has become unfeasible and therefore we need to drop our security support for the version in oldstable. We recommend that all asterisk users upgrade to the stable distribution (lenny).

- Thu Nov 5 2009 Jeffrey C. Ollie <jeff at ocjtech.us> -     1.6.0.17-2 - Fix firmware path * Wed Nov 4 2009 Jeffrey     C. Ollie <jeff at ocjtech.us> - 1.6.0.17-1 - Update to     1.6.0.17 to fix AST-2009-009/CVE-2008-7220 - Merge the     firmware subpackage back into the main package. - Don't     package the iaxy firmware anymore.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Nov 4 2009 Jeffrey C. Ollie <jeff at ocjtech.us> -     1.6.1.9-1 - Update to 1.6.1.9 to fix     AST-2009-009/CVE-2008-7220 and AST-2009-008 - Fix     obsoletes for firmware subpackage

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
46809	GLSA-201006-20 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
44817	Debian DSA-1952-1 : asterisk - several vulnerabilities, end-of-life announcement in oldstable	Nessus	Debian Local Security Checks	high
42884	Fedora 10 : asterisk-1.6.0.17-2.fc10 (2009-11126)	Nessus	Fedora Local Security Checks	high
42883	Fedora 11 : asterisk-1.6.1.9-1.fc11 (2009-11070)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2009-3727

medium

Tenable Plugins

high

high

high

high