CVE-2009-3727: Infoleak
Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, 1.6.0.x before 1.6.0.17, and 1.6.1.x before 1.6.1.9; Business Edition A.x.x, B.x.x before B.2.5.12, C.2.x.x before C.2.4.5, and C.3.x.x before C.3.2.2; AsteriskNOW 1.5; and s800i 1.3.x before 1.3.0.5 generate different error messages depending on whether a SIP username is valid, which allows remote attackers to enumerate valid usernames via multiple crafted REGISTER messages with inconsistent usernames in the URI in the To header and the Digest in the Authorization header.
Other sources
Asterisk upstream has released advisory and patches fixing one informationn leak issue:
http://downloads.asterisk.org/pub/security/AST-2009-008.html
Upstream patches: ----------------- http://downloads.digium.com/pub/asa/AST-2009-008-1.2.diff.txt http://downloads.digium.com/pub/asa/AST-2009-008-1.4.diff.txt http://downloads.digium.com/pub/asa/AST-2009-008-1.6.0.diff.txt http://downloads.digium.com/pub/asa/AST-2009-008-1.6.1.diff.txt
CVE Request: ------------ http://www.openwall.com/lists/oss-security/2009/11/05/2
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3727?
CVE-2009-3727 is classified with a moderate severity due to its potential to cause exposure of sensitive information.
How do I mitigate CVE-2009-3727?
To mitigate CVE-2009-3727, upgrade to the patched versions of Asterisk, specifically 1.2.35, 1.4.26.3, 1.6.0.17, or 1.6.1.9 or later.
What versions of Asterisk are affected by CVE-2009-3727?
CVE-2009-3727 affects multiple versions including 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, and 1.6.0.x before 1.6.0.17.
Are Business Editions of Asterisk affected by CVE-2009-3727?
Yes, the Business Edition A.x.x, B.x.x before B.2.5.12, and C.x.x before C.2.4.5 are affected by CVE-2009-3727.
Is AsteriskNOW impacted by CVE-2009-3727?
Yes, AsteriskNOW version 1.5 is also impacted by the CVE-2009-3727 vulnerability.