chan_sip.c in the SIP channel driver in Asterisk Open Source 1.4.x before 1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and Asterisk Business Edition C.3.x before C.3.7.3, disregards the alwaysauthreject option and generates different responses for invalid SIP requests depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of requests.

According to the version in its SIP banner, the version of Asterisk running on the remote host allows a remote attacker to enumerate valid users by sending malformed SIP INVITE and REGISTER requests.

The remote host is affected by the vulnerability described in GLSA-201110-21 (Asterisk: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Asterisk. Please review       the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may execute code with the privileges       of the Asterisk process or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The Asterisk Development Team reports :

AST-2011-008: If a remote user sends a SIP packet containing a NULL, Asterisk assumes available data extends past the null to the end of the packet when the buffer is actually truncated when copied. This causes SIP header parsing to modify data past the end of the buffer altering unrelated memory structures. This vulnerability does not affect TCP/TLS connections.

AST-2011-009: A remote user sending a SIP packet containing a Contact header with a missing left angle bracket causes Asterisk to access a NULL pointer.

AST-2011-010: A memory address was inadvertently transmitted over the network via IAX2 via an option control frame and the remote party would try to access it.

Possible enumeration of SIP users due to differing authentication responses.

ID	Name	Product	Family	Severity
56921	Asterisk Invalid INVITE / REGISTER SIP Request Username Enumeration (AST-2011-011)	Nessus	Misc.	medium
56625	GLSA-201110-21 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
55430	FreeBSD : Asterisk -- multiple vulnerabilities (40544e8c-9f7b-11e0-9bec-6c626dd55a41)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2011-2536

medium

Tenable Plugins

medium

high

medium