An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However, if an endpoint is not identified, then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot be bypassed to gain access to the disclosed endpoints.

The remote host is affected by the vulnerability described in GLSA-201811-11 (Asterisk: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Asterisk. Please review       the referenced CVE identifiers for details.
  Impact :

    A remote attacker could cause a Denial of Service condition or conduct       information gathering.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities have been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in denial of service or information disclosure.

According to its SIP banner, the version of Asterisk running on the remote host is 13.x prior to 13.21.1, 14.x prior to 14.7.7, or 13.18 prior to 13.18-cert4. It is therefore, affected by a remote denial of service attack as described in AST-2018-008.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its SIP banner, the version of Asterisk running on the remote host is 15.x prior to 15.4.1. It is therefore, affected by multiple vulnerabilities as described in AST-2018-007 & AST-2018-008 advisories.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
119131	GLSA-201811-11 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
118158	Debian DSA-4320-1 : asterisk - security update	Nessus	Debian Local Security Checks	medium
110562	Asterisk 13.x < 13.21.1 / 14.x < 14.7.7 / 13.13 < 13.18-cert4 / 13.21 < 13.21-cert2 Information Disclosure Vulnerability (AST-2018-008)	Nessus	Misc.	medium
110561	Asterisk 15.x < 15.4.1 Multiple Vulnerabilities (AST-2018-007 - AST-2018-008)	Nessus	Misc.	medium

Detections

Analytics

CVE-2018-12227

medium

Tenable Plugins

high

medium

medium

medium