Lucene search
HistoryApr 01, 2013 - 4:55 p.m.
CVE-2013-2264
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
AI Score
6.4
Confidence
Low
EPSS
0.005
Percentile
75.4%
The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business Edition (BE) C.3.x before C.3.8.1; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones exhibits different behavior for invalid INVITE, SUBSCRIBE, and REGISTER transactions depending on whether the user account exists, which allows remote attackers to enumerate account names by (1) reading HTTP status codes, (2) reading additional text in a 403 (aka Forbidden) response, or (3) observing whether certain retransmissions occur.
Affected configurations
Node
asteriskopen_sourceMatch1.8.0
ORasteriskopen_sourceMatch1.8.0beta1
ORasteriskopen_sourceMatch1.8.0beta2
ORasteriskopen_sourceMatch1.8.0beta3
ORasteriskopen_sourceMatch1.8.0beta4
ORasteriskopen_sourceMatch1.8.0beta5
ORasteriskopen_sourceMatch1.8.0rc2
ORasteriskopen_sourceMatch1.8.0rc3
ORasteriskopen_sourceMatch1.8.0rc4
ORasteriskopen_sourceMatch1.8.0rc5
ORasteriskopen_sourceMatch1.8.1
ORasteriskopen_sourceMatch1.8.1rc1
ORasteriskopen_sourceMatch1.8.1.1
ORasteriskopen_sourceMatch1.8.1.2
ORasteriskopen_sourceMatch1.8.2
ORasteriskopen_sourceMatch1.8.2rc1
ORasteriskopen_sourceMatch1.8.2.1
ORasteriskopen_sourceMatch1.8.2.2
ORasteriskopen_sourceMatch1.8.2.3
ORasteriskopen_sourceMatch1.8.2.4
ORasteriskopen_sourceMatch1.8.3
ORasteriskopen_sourceMatch1.8.3rc1
ORasteriskopen_sourceMatch1.8.3rc2
ORasteriskopen_sourceMatch1.8.3rc3
ORasteriskopen_sourceMatch1.8.3.1
ORasteriskopen_sourceMatch1.8.3.2
ORasteriskopen_sourceMatch1.8.3.3
ORasteriskopen_sourceMatch1.8.4
ORasteriskopen_sourceMatch1.8.4rc1
ORasteriskopen_sourceMatch1.8.4rc2
ORasteriskopen_sourceMatch1.8.4rc3
ORasteriskopen_sourceMatch1.8.4.1
ORasteriskopen_sourceMatch1.8.4.2
ORasteriskopen_sourceMatch1.8.4.3
ORasteriskopen_sourceMatch1.8.4.4
ORasteriskopen_sourceMatch1.8.5rc1
ORasteriskopen_sourceMatch1.8.5.0
ORasteriskopen_sourceMatch1.8.6.0
ORasteriskopen_sourceMatch1.8.6.0rc1
ORasteriskopen_sourceMatch1.8.6.0rc2
ORasteriskopen_sourceMatch1.8.6.0rc3
ORasteriskopen_sourceMatch1.8.7.0
ORasteriskopen_sourceMatch1.8.7.0rc1
ORasteriskopen_sourceMatch1.8.7.0rc2
ORasteriskopen_sourceMatch1.8.7.1
ORasteriskopen_sourceMatch1.8.7.2
ORasteriskopen_sourceMatch1.8.8.0
ORasteriskopen_sourceMatch1.8.8.0rc1
ORasteriskopen_sourceMatch1.8.8.0rc2
ORasteriskopen_sourceMatch1.8.8.0rc3
ORasteriskopen_sourceMatch1.8.8.0rc4
ORasteriskopen_sourceMatch1.8.8.0rc5
ORasteriskopen_sourceMatch1.8.8.1
ORasteriskopen_sourceMatch1.8.8.2
ORasteriskopen_sourceMatch1.8.9.0
ORasteriskopen_sourceMatch1.8.9.0rc1
ORasteriskopen_sourceMatch1.8.9.0rc2
ORasteriskopen_sourceMatch1.8.9.0rc3
ORasteriskopen_sourceMatch1.8.9.1
ORasteriskopen_sourceMatch1.8.9.2
ORasteriskopen_sourceMatch1.8.9.3
ORasteriskopen_sourceMatch1.8.10.0
ORasteriskopen_sourceMatch1.8.10.0rc1
ORasteriskopen_sourceMatch1.8.10.0rc2
ORasteriskopen_sourceMatch1.8.10.0rc3
ORasteriskopen_sourceMatch1.8.10.0rc4
ORasteriskopen_sourceMatch1.8.10.1
ORasteriskopen_sourceMatch1.8.11.0
ORasteriskopen_sourceMatch1.8.11.0rc2
ORasteriskopen_sourceMatch1.8.11.0rc3
ORasteriskopen_sourceMatch1.8.11.1
ORasteriskopen_sourceMatch1.8.12
ORasteriskopen_sourceMatch1.8.12.0rc1
ORasteriskopen_sourceMatch1.8.12.0rc2
ORasteriskopen_sourceMatch1.8.12.0rc3
ORasteriskopen_sourceMatch1.8.12.1
ORasteriskopen_sourceMatch1.8.12.2
ORasteriskopen_sourceMatch1.8.13.0
ORasteriskopen_sourceMatch1.8.13.0rc1
ORasteriskopen_sourceMatch1.8.13.0rc2
ORasteriskopen_sourceMatch1.8.13.1
ORasteriskopen_sourceMatch1.8.14.0
ORasteriskopen_sourceMatch1.8.14.0rc1
ORasteriskopen_sourceMatch1.8.14.0rc2
ORasteriskopen_sourceMatch1.8.14.1
ORasteriskopen_sourceMatch1.8.15.0
ORasteriskopen_sourceMatch1.8.15.0rc1
ORasteriskopen_sourceMatch1.8.15.1
ORasteriskopen_sourceMatch1.8.16.0
ORasteriskopen_sourceMatch1.8.16.0rc1
ORasteriskopen_sourceMatch1.8.16.0rc2
ORasteriskopen_sourceMatch1.8.17.0
ORasteriskopen_sourceMatch1.8.17.0rc1
ORasteriskopen_sourceMatch1.8.17.0rc2
ORasteriskopen_sourceMatch1.8.17.0rc3
ORasteriskopen_sourceMatch1.8.18.0
ORasteriskopen_sourceMatch1.8.18.0rc1
ORasteriskopen_sourceMatch1.8.18.1
ORasteriskopen_sourceMatch1.8.19.0
ORasteriskopen_sourceMatch1.8.19.0rc1
ORasteriskopen_sourceMatch1.8.19.0rc3
ORasteriskopen_sourceMatch1.8.19.1
ORasteriskopen_sourceMatch1.8.20.0
ORasteriskopen_sourceMatch1.8.20.0rc1
ORasteriskopen_sourceMatch1.8.20.0rc2
ORasteriskopen_sourceMatch1.8.20.1
Node
asteriskopen_sourceMatch10.0.0
ORasteriskopen_sourceMatch10.0.0beta1
ORasteriskopen_sourceMatch10.0.0beta2
ORasteriskopen_sourceMatch10.0.0rc1
ORasteriskopen_sourceMatch10.0.0rc2
ORasteriskopen_sourceMatch10.0.0rc3
ORasteriskopen_sourceMatch10.0.1
ORasteriskopen_sourceMatch10.1.0
ORasteriskopen_sourceMatch10.1.0rc1
ORasteriskopen_sourceMatch10.1.0rc2
ORasteriskopen_sourceMatch10.1.1
ORasteriskopen_sourceMatch10.1.2
ORasteriskopen_sourceMatch10.1.3
ORasteriskopen_sourceMatch10.2.0
ORasteriskopen_sourceMatch10.2.0rc1
ORasteriskopen_sourceMatch10.2.0rc2
ORasteriskopen_sourceMatch10.2.0rc3
ORasteriskopen_sourceMatch10.2.0rc4
ORasteriskopen_sourceMatch10.2.1
ORasteriskopen_sourceMatch10.3.0
ORasteriskopen_sourceMatch10.3.0rc2
ORasteriskopen_sourceMatch10.3.0rc3
ORasteriskopen_sourceMatch10.3.1
ORasteriskopen_sourceMatch10.4.0
ORasteriskopen_sourceMatch10.4.0rc1
ORasteriskopen_sourceMatch10.4.0rc2
ORasteriskopen_sourceMatch10.4.0rc3
ORasteriskopen_sourceMatch10.4.1
ORasteriskopen_sourceMatch10.4.2
ORasteriskopen_sourceMatch10.5.0
ORasteriskopen_sourceMatch10.5.0rc1
ORasteriskopen_sourceMatch10.5.0rc2
ORasteriskopen_sourceMatch10.5.1
ORasteriskopen_sourceMatch10.5.2
ORasteriskopen_sourceMatch10.6.0
ORasteriskopen_sourceMatch10.6.0rc1
ORasteriskopen_sourceMatch10.6.0rc2
ORasteriskopen_sourceMatch10.6.1
ORasteriskopen_sourceMatch10.7.0
ORasteriskopen_sourceMatch10.7.0rc1
ORasteriskopen_sourceMatch10.7.1
ORasteriskopen_sourceMatch10.8.0
ORasteriskopen_sourceMatch10.8.0rc1
ORasteriskopen_sourceMatch10.8.0rc2
ORasteriskopen_sourceMatch10.9.0
ORasteriskopen_sourceMatch10.9.0rc1
ORasteriskopen_sourceMatch10.9.0rc2
ORasteriskopen_sourceMatch10.9.0rc3
ORasteriskopen_sourceMatch10.10.0
ORasteriskopen_sourceMatch10.10.0rc1
ORasteriskopen_sourceMatch10.10.0rc2
ORasteriskopen_sourceMatch10.10.1
ORasteriskopen_sourceMatch10.11.0
ORasteriskopen_sourceMatch10.11.0rc1
ORasteriskopen_sourceMatch10.11.0rc3
ORasteriskopen_sourceMatch10.11.1
ORasteriskopen_sourceMatch10.12.0
ORasteriskopen_sourceMatch10.12.0rc1
ORasteriskopen_sourceMatch10.12.0rc2
ORasteriskopen_sourceMatch10.12.1
Node
asteriskopen_sourceMatch11.0.0
ORasteriskopen_sourceMatch11.0.0beta1
ORasteriskopen_sourceMatch11.0.0beta2
ORasteriskopen_sourceMatch11.0.0rc1
ORasteriskopen_sourceMatch11.0.0rc2
ORasteriskopen_sourceMatch11.0.1
ORasteriskopen_sourceMatch11.0.2
ORasteriskopen_sourceMatch11.1.0
ORasteriskopen_sourceMatch11.1.0rc1
ORasteriskopen_sourceMatch11.1.0rc3
ORasteriskopen_sourceMatch11.1.1
ORasteriskopen_sourceMatch11.1.2
ORasteriskopen_sourceMatch11.2.0
ORasteriskopen_sourceMatch11.2.0rc1
ORasteriskopen_sourceMatch11.2.0rc2
ORasteriskopen_sourceMatch11.2.1
Node
asteriskcertified_asteriskMatch1.8.15cert1
ORasteriskcertified_asteriskMatch1.8.15cert1rc1
ORasteriskcertified_asteriskMatch1.8.15cert1rc2
ORasteriskcertified_asteriskMatch1.8.15cert1rc3
ORasteriskcertified_asteriskMatch1.8.15.0
ORasteriskcertified_asteriskMatch1.8.15.0rc1
Node
asteriskbusiness_editionMatchc.3.2.2
ORasteriskbusiness_editionMatchc.3.3
ORasteriskbusiness_editionMatchc.3.3.2
Node
asteriskdigiumphonesMatch10.0.0
ORasteriskdigiumphonesMatch10.0.0beta1
ORasteriskdigiumphonesMatch10.0.0beta2
ORasteriskdigiumphonesMatch10.0.0rc1
ORasteriskdigiumphonesMatch10.0.0rc2
ORasteriskdigiumphonesMatch10.0.0rc3
ORasteriskdigiumphonesMatch10.1.0
ORasteriskdigiumphonesMatch10.1.0rc1
ORasteriskdigiumphonesMatch10.1.0rc2
ORasteriskdigiumphonesMatch10.2.0
ORasteriskdigiumphonesMatch10.2.0rc1
ORasteriskdigiumphonesMatch10.2.0rc2
ORasteriskdigiumphonesMatch10.2.0rc3
ORasteriskdigiumphonesMatch10.2.0rc4
ORasteriskdigiumphonesMatch10.3.0
ORasteriskdigiumphonesMatch10.3.0rc2
ORasteriskdigiumphonesMatch10.3.0rc3
ORasteriskdigiumphonesMatch10.4.0
ORasteriskdigiumphonesMatch10.4.0rc1
ORasteriskdigiumphonesMatch10.4.0rc2
ORasteriskdigiumphonesMatch10.4.0rc3
ORasteriskdigiumphonesMatch10.5.0
ORasteriskdigiumphonesMatch10.5.0rc1
ORasteriskdigiumphonesMatch10.5.0rc2
ORasteriskdigiumphonesMatch10.6.0
ORasteriskdigiumphonesMatch10.6.0rc1
ORasteriskdigiumphonesMatch10.6.0rc2
ORasteriskdigiumphonesMatch10.7.0
ORasteriskdigiumphonesMatch10.7.0rc1
ORasteriskdigiumphonesMatch10.8.0
ORasteriskdigiumphonesMatch10.8.0rc1
ORasteriskdigiumphonesMatch10.8.0rc2
ORasteriskdigiumphonesMatch10.9.0rc1
ORasteriskdigiumphonesMatch10.10.0
ORasteriskdigiumphonesMatch10.10.0rc1
ORasteriskdigiumphonesMatch10.10.0rc2
ORasteriskdigiumphonesMatch10.11.0
ORasteriskdigiumphonesMatch10.11.0rc1
ORasteriskdigiumphonesMatch10.11.0rc2
ORasteriskdigiumphonesMatch10.11.0rc3
ORasteriskdigiumphonesMatch10.12.0
ORasteriskdigiumphonesMatch10.12.0rc1
ORasteriskdigiumphonesMatch10.12.0rc2
ORasteriskdigiumphonesMatch10.12.1
Related
securityvulns
securityvulns
AST-2013-003: Username disclosure in SIP channel driver
2013-04-01 00:00:00
Asterisk multiple security vulnerabilities
2013-04-01 00:00:00
cvelist
cvelist
CVE-2013-2264
2022-10-03 16:14:59
debiancve
debiancve
CVE-2013-2264
2022-10-03 16:14:59
prion
prion
Code injection
2013-04-01 16:55:00
ubuntucve
ubuntucve
CVE-2013-2264
2013-04-01 00:00:00
nessus
nessus
Asterisk SIP Channel Driver Username Disclosure (AST-2013-003)
2013-04-10 00:00:00
Fedora 17 : asterisk-10.12.2-1.fc17 (2013-4528)
2013-04-08 00:00:00
cve
cve
CVE-2013-2264
2022-10-03 16:14:59
fedora
fedora
[SECURITY] Fedora 17 Update: asterisk-10.12.2-1.fc17
2013-04-07 00:44:42
openvas
openvas
Fedora Update for asterisk FEDORA-2013-4528
2013-04-08 00:00:00
Fedora Update for asterisk FEDORA-2013-4528
2013-04-08 00:00:00
Gentoo Security Advisory GLSA 201401-15
2015-09-29 00:00:00
freebsd
freebsd
asterisk -- multiple vulnerabilities
2013-03-27 00:00:00
gentoo
gentoo
Asterisk: Multiple vulnerabilities
2014-01-21 00:00:00
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
AI Score
6.4
Confidence
Low
EPSS
0.005
Percentile
75.4%
Related for NVD:CVE-2013-2264