CVE-2011-2536: Infoleak

Published Jul 6, 2011

Updated

chansip.c in the SIP channel driver in Asterisk Open Source 1.4.x before 1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and Asterisk Business Edition C.3.x before C.3.7.3, disregards the alwaysauthreject option and generates different responses for invalid SIP requests depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of requests.

Affected Software

198 affected components

Asterisk=1.8.0

Asterisk=1.8.0-beta1

Asterisk=1.8.0-beta2

Asterisk=1.8.0-beta3

Asterisk=1.8.0-beta4

Asterisk=1.8.0-beta5

Asterisk=1.8.0-rc2

Asterisk=1.8.0-rc3

Asterisk=1.8.0-rc4

Asterisk=1.8.0-rc5

Asterisk=1.8.1

Asterisk=1.8.1-rc1

Asterisk=1.8.1.1

Asterisk=1.8.1.2

Asterisk=1.8.2

Asterisk=1.8.2.1

Asterisk=1.8.2.2

Asterisk=1.8.2.3

Asterisk=1.8.2.4

Asterisk=1.8.3

Asterisk=1.8.3-rc1

Asterisk=1.8.3-rc2

Asterisk=1.8.3-rc3

Asterisk=1.8.3.1

Asterisk=1.8.3.2

Asterisk=1.8.3.3

Asterisk=1.8.4

Asterisk=1.8.4-rc1

Asterisk=1.8.4-rc2

Asterisk=1.8.4-rc3

Asterisk=1.8.4.1

Asterisk=1.8.4.2

Asterisk=1.8.4.3

Asterisk=1.6.2.0

Asterisk=1.6.2.0-rc2

Asterisk=1.6.2.0-rc3

Asterisk=1.6.2.0-rc4

Asterisk=1.6.2.0-rc5

Asterisk=1.6.2.0-rc6

Asterisk=1.6.2.0-rc7

Asterisk=1.6.2.0-rc8

Asterisk=1.6.2.1

Asterisk=1.6.2.1-rc1

Asterisk=1.6.2.2

Asterisk=1.6.2.3-rc2

Asterisk=1.6.2.4

Asterisk=1.6.2.5

Asterisk=1.6.2.6

Asterisk=1.6.2.6-rc1

Asterisk=1.6.2.6-rc2

Asterisk=1.6.2.15-rc1

Asterisk=1.6.2.16

Asterisk=1.6.2.16-rc1

Asterisk=1.6.2.16.1

Asterisk=1.6.2.16.2

Asterisk=1.6.2.17

Asterisk=1.6.2.17-rc1

Asterisk=1.6.2.17-rc2

Asterisk=1.6.2.17-rc3

Asterisk=1.6.2.17.1

Asterisk=1.6.2.17.2

Asterisk=1.6.2.17.3

Asterisk=1.6.2.18

Asterisk=1.6.2.18-rc1

Asterisk=1.6.2.18.1

Asterisk=1.4.0

Asterisk=1.4.0-beta1

Asterisk=1.4.0-beta2

Asterisk=1.4.0-beta3

Asterisk=1.4.0-beta4

Asterisk=1.4.1

Asterisk=1.4.2

Asterisk=1.4.3

Asterisk=1.4.4

Asterisk=1.4.5

Asterisk=1.4.6

Asterisk=1.4.7

Asterisk=1.4.7.1

Asterisk=1.4.8

Asterisk=1.4.9

Asterisk=1.4.10

Asterisk=1.4.10.1

Asterisk=1.4.11

Asterisk=1.4.12

Asterisk=1.4.12.1

Asterisk=1.4.13

Asterisk=1.4.14

Asterisk=1.4.15

Asterisk=1.4.16

Asterisk=1.4.16.1

Asterisk=1.4.16.2

Asterisk=1.4.17

Asterisk=1.4.18

Asterisk=1.4.19

Asterisk=1.4.19-rc1

Asterisk=1.4.19-rc2

Asterisk=1.4.19-rc3

Asterisk=1.4.19-rc4

Asterisk=1.4.19.1

Asterisk=1.4.19.2

Asterisk=1.4.20

Asterisk=1.4.20-rc1

Asterisk=1.4.20-rc2

Asterisk=1.4.20-rc3

Asterisk=1.4.20.1

Asterisk=1.4.21

Asterisk=1.4.21-rc1

Asterisk=1.4.21-rc2

Asterisk=1.4.21.1

Asterisk=1.4.21.2

Asterisk=1.4.22

Asterisk=1.4.22-rc1

Asterisk=1.4.22-rc2

Asterisk=1.4.22-rc3

Asterisk=1.4.22-rc4

Asterisk=1.4.22-rc5

Asterisk=1.4.22.1

Asterisk=1.4.22.2

Asterisk=1.4.23

Asterisk=1.4.23-rc1

Asterisk=1.4.23-rc2

Asterisk=1.4.23-rc3

Asterisk=1.4.23-rc4

Asterisk=1.4.23.1

Asterisk=1.4.23.2

Asterisk=1.4.24

Asterisk=1.4.24-rc1

Asterisk=1.4.24.1

Asterisk=1.4.25

Asterisk=1.4.25-rc1

Asterisk=1.4.25.1

Asterisk=1.4.26

Asterisk=1.4.26-rc1

Asterisk=1.4.26-rc2

Asterisk=1.4.26-rc3

Asterisk=1.4.26-rc4

Asterisk=1.4.26-rc5

Asterisk=1.4.26-rc6

Asterisk=1.4.26.1

Asterisk=1.4.26.2

Asterisk=1.4.26.3

Asterisk=1.4.27

Asterisk=1.4.27-rc1

Asterisk=1.4.27-rc2

Asterisk=1.4.27-rc3

Asterisk=1.4.27-rc4

Asterisk=1.4.27-rc5

Asterisk=1.4.27.1

Asterisk=1.4.28

Asterisk=1.4.28-rc1

Asterisk=1.4.29

Asterisk=1.4.29-rc1

Asterisk=1.4.29.1

Asterisk=1.4.30

Asterisk=1.4.30-rc2

Asterisk=1.4.30-rc3

Asterisk=1.4.31

Asterisk=1.4.31-rc1

Asterisk=1.4.31-rc2

Asterisk=1.4.32

Asterisk=1.4.32-rc1

Asterisk=1.4.33

Asterisk=1.4.33-rc1

Asterisk=1.4.33-rc2

Asterisk=1.4.33.1

Asterisk=1.4.34

Asterisk=1.4.34-rc1

Asterisk=1.4.34-rc2

Asterisk=1.4.35

Asterisk=1.4.35-rc1

Asterisk=1.4.36

Asterisk=1.4.36-rc1

Asterisk=1.4.37

Asterisk=1.4.37-rc1

Asterisk=1.4.38

Asterisk=1.4.38-rc1

Asterisk=1.4.39

Asterisk=1.4.39-rc1

Asterisk=1.4.39.1

Asterisk=1.4.39.2

Asterisk=1.4.40

Asterisk=1.4.40-rc1

Asterisk=1.4.40-rc2

Asterisk=1.4.40-rc3

Asterisk=1.4.40.1

Asterisk=1.4.40.2

Asterisk=1.4.41

Asterisk=1.4.41-rc1

Asterisk=1.4.41.1

Asterisk=c.3.0

Asterisk=c.3.1.0

Asterisk=c.3.1.1

Asterisk=c.3.2.2

Asterisk=c.3.2.3

Asterisk=c.3.3.2

Asterisk=c.3.6.2

Asterisk=c.3.6.3

Asterisk=c.3.6.4

Remediation

Patch Available

http://downloads.asterisk.org/pub/security/AST-2011-011-1.8.diff

Event History

Jul 6, 2011

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-2536?

CVE-2011-2536 is classified as a medium severity vulnerability that can lead to security breaches in Asterisk.

How do I fix CVE-2011-2536?

To fix CVE-2011-2536, upgrade Asterisk to version 1.4.41.2 or higher, 1.6.2.18.2 or higher, or 1.8.4.4 or higher.

What is the impact of CVE-2011-2536?

CVE-2011-2536 can allow attackers to exploit differences in response behaviors, potentially leading to unauthorized access or information disclosure.

Which Asterisk versions are affected by CVE-2011-2536?

CVE-2011-2536 affects Asterisk Open Source versions prior to 1.4.41.2, 1.6.2.18.2, and 1.8.4.4, as well as prior versions of Asterisk Business Edition.

Is CVE-2011-2536 related to SIP security?

Yes, CVE-2011-2536 is related to SIP security issues within the Asterisk SIP channel driver.