CVE-2009-1803: Infoleak

Published May 28, 2009

Updated

FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.

Affected Software

14 affected components

FreePBX FreePBX=2.4

FreePBX FreePBX=2.4.0_beta1

FreePBX FreePBX=2.4.0_beta2

FreePBX FreePBX=2.4.1

FreePBX FreePBX=2.5

FreePBX FreePBX=2.5.0_beta1

FreePBX FreePBX=2.5.0rc2

FreePBX FreePBX=2.5.0rc3

FreePBX FreePBX=2.5.1

FreePBX FreePBX=2.5.2

Sangoma FreePBX =2.4.0

Sangoma FreePBX =2.5.0

FreePBX=2.4.0

FreePBX=2.5.0

Remediation

Patch Available

http://www.securityfocus.com/bid/34857

Event History

May 28, 2009

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-1803?

CVE-2009-1803 is rated as a medium severity vulnerability due to its ability to allow username enumeration.

How do I fix CVE-2009-1803?

To fix CVE-2009-1803, update your FreePBX installation to a version that addresses this vulnerability.

What versions of FreePBX are affected by CVE-2009-1803?

CVE-2009-1803 affects FreePBX versions 2.4.x, 2.5.x, and pre-release 2.6.x, including version 2.5.1.

What type of attack does CVE-2009-1803 enable?

CVE-2009-1803 enables remote attackers to enumerate valid usernames through differing error messages.

Is there a workaround for CVE-2009-1803?

A potential workaround for CVE-2009-1803 is to modify the error response mechanics, but updating to a patched version is recommended.