CERTA-2009-AVI-129

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité dans Asterisk permet à un utilisateur malveillant d'obtenir des informations sensibles.

Description

Quand Asterisk est utilisé avec l'option alwaysauthreject, la réponse SIP diffère selon que l'utilisateur existe ou n'existe pas. Cette différence est exploitable par un utilisateur malveillant pour obtenir la liste des utilisateurs valides.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
Asterisk N/A Asterik Business Edition ;
Asterisk N/A Asterik Appliance s800i.
Asterisk Asterisk Asterisk Open Source 1.x ;
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Asterik Business Edition ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Asterisk",
          "scada": false
        }
      }
    },
    {
      "description": "Asterik Appliance s800i.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Asterisk",
          "scada": false
        }
      }
    },
    {
      "description": "Asterisk Open Source 1.x ;",
      "product": {
        "name": "Asterisk",
        "vendor": {
          "name": "Asterisk",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nQuand Asterisk est utilis\u00e9 avec l\u0027option alwaysauthreject, la r\u00e9ponse\nSIP diff\u00e8re selon que l\u0027utilisateur existe ou n\u0027existe pas. Cette\ndiff\u00e9rence est exploitable par un utilisateur malveillant pour obtenir\nla liste des utilisateurs valides.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-3903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-3903"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 du projet Asterisk AST-2009-003 du 02    avril 2009 :",
      "url": "http://www.asterisk.org/node/48582"
    }
  ],
  "reference": "CERTA-2009-AVI-129",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-04-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans Asterisk permet \u00e0 un utilisateur malveillant\nd\u0027obtenir des informations sensibles.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Asterisk",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 du projet Asterisk AST-2009-003 du 02 avril 2009",
      "url": null
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.