NetSight
IP …
medium5.0

CVE-2009-0041

IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x …

Impact

IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and C.2.x.x before C.2.1.2.1; and s800i 1.2.x before 1.3.0 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.

Affected products

VendorProductAffected versions
AsteriskAsterisk Business Edition
through b.2.5.2
through c.1.0
Versions a, b.1.3.2, b.1.3.3, b.2.2.0
AsteriskOpen Source
through 1.2.30.4
through 1.4.23
through 1.6.0.3
Versions 1.2.0, 1.2.0beta1, 1.2.0beta2
AsteriskS800i Appliance
Version 1.2

Weakness classification

CWE-200

References