CERTA-2009-AVI-129
Vulnerability from certfr_avis

Une vulnérabilité dans Asterisk permet à un utilisateur malveillant d'obtenir des informations sensibles.

Description

Quand Asterisk est utilisé avec l'option alwaysauthreject, la réponse SIP diffère selon que l'utilisateur existe ou n'existe pas. Cette différence est exploitable par un utilisateur malveillant pour obtenir la liste des utilisateurs valides.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
Asterisk N/A Asterik Business Edition ;
Asterisk N/A Asterik Appliance s800i.
Asterisk Asterisk Asterisk Open Source 1.x ;
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Asterik Business Edition ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Asterisk",
          "scada": false
        }
      }
    },
    {
      "description": "Asterik Appliance s800i.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Asterisk",
          "scada": false
        }
      }
    },
    {
      "description": "Asterisk Open Source 1.x ;",
      "product": {
        "name": "Asterisk",
        "vendor": {
          "name": "Asterisk",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nQuand Asterisk est utilis\u00e9 avec l\u0027option alwaysauthreject, la r\u00e9ponse\nSIP diff\u00e8re selon que l\u0027utilisateur existe ou n\u0027existe pas. Cette\ndiff\u00e9rence est exploitable par un utilisateur malveillant pour obtenir\nla liste des utilisateurs valides.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-3903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-3903"
    }
  ],
  "initial_release_date": "2009-04-06T00:00:00",
  "last_revision_date": "2009-04-06T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 du projet Asterisk AST-2009-003 du 02    avril 2009 :",
      "url": "http://www.asterisk.org/node/48582"
    }
  ],
  "reference": "CERTA-2009-AVI-129",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-04-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans Asterisk permet \u00e0 un utilisateur malveillant\nd\u0027obtenir des informations sensibles.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Asterisk",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 du projet Asterisk AST-2009-003 du 02 avril 2009",
      "url": null
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.