Bug 461271 (CVE-2008-3903)

Summary:	CVE-2008-3903 asterisk: SIP valid account enumeration flaw
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jeff, jlieskov
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-11-02 19:32:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Tomas Hoger 2008-09-05 13:27:06 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-3903 to the following vulnerability:

Asterisk PBX 1.2 through 1.6 and Trixbox PBX 2.6.1, when running with
Digest authentication and authalwaysreject enabled, generates
different responses depending on whether or not a SIP username is
valid, which allows remote attackers to enumerate valid usernames.

References:
http://misel.com/?p=52

Comment 1 Tomas Hoger 2008-09-05 13:28:34 UTC

Referenced advisory contains proposed patch, but there does not seem to be an official upstream advisory for this issue yet.

Comment 2 Jan Lieskovsky 2009-05-12 14:47:48 UTC

Upstream advisory with patches:

http://downloads.asterisk.org/pub/security/AST-2009-003.html

CVE-2008-3903 entry:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3903

Comment 3 Jeffrey C. Ollie 2009-11-02 19:24:17 UTC

I believe that this can be closed as 1.6.0.15 is the current version in F-10 and F-11+ are running 1.6.1.x.

Comment 4 Tomas Hoger 2009-11-02 19:32:11 UTC

Right, thanks!