CVE-2011-2536

2011-07-0600:00:00

ubuntu.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.004 Low

EPSS

Percentile

73.3%

JSON

chan_sip.c in the SIP channel driver in Asterisk Open Source 1.4.x before
1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and Asterisk
Business Edition C.3.x before C.3.7.3, disregards the alwaysauthreject
option and generates different responses for invalid SIP requests depending
on whether the user account exists, which allows remote attackers to
enumerate account names via a series of requests.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632029>

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchasterisk< 1:1.6.2.5-0ubuntu1.4UNKNOWN
ubuntu10.10noarchasterisk< 1:1.6.2.7-1ubuntu1.2UNKNOWN
ubuntu11.04noarchasterisk< 1:1.6.2.9-2ubuntu2.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	asterisk	< 1:1.6.2.5-0ubuntu1.4	UNKNOWN
ubuntu	10.10	noarch	asterisk	< 1:1.6.2.7-1ubuntu1.2	UNKNOWN
ubuntu	11.04	noarch	asterisk	< 1:1.6.2.9-2ubuntu2.1	UNKNOWN