[AsteriskBrasil] Fwd: [asterisk-dev] AST-2013-003: Username disclosure in SIP channel driver

[Sylvio Jollenbeck]

PSC

---------- Forwarded message ----------
From: Asterisk Security Team <security em asterisk.org>
Date: 2013/3/27
Subject: [asterisk-dev] AST-2013-003: Username disclosure in SIP channel
driver
To: asterisk-dev em lists.digium.com


               Asterisk Project Security Advisory - AST-2013-003

          Product         Asterisk
          Summary         Username disclosure in SIP channel driver
     Nature of Advisory   Unauthorized data disclosure
       Susceptibility     Remote Unauthenticated Sessions
          Severity        Moderate
       Exploits Known     No
        Reported On       January 30, 2013
        Reported By       Walter Doekes, OSSO B.V.
         Posted On        February 21, 2013
      Last Updated On     March 27, 2013
      Advisory Contact    Kinsey Moore <kmoore em digium.com>
          CVE Name        CVE-2013-2264

    Description  When authenticating via SIP with alwaysauthreject enabled,
                 allowguest disabled, and autocreatepeer disabled, Asterisk
                 discloses whether a user exists for INVITE, SUBSCRIBE, and
                 REGISTER transactions in multiple ways.

                 This information was disclosed:

                 * when a "407 Proxy Authentication Required" response was
                 sent instead of "401 Unauthorized" response.

                 * due to the presence or absence of additional tags at the
                 end of "403 Forbidden" such as "(Bad auth)".

                 * when a "401 Unauthorized" response was sent instead of
                 "403 Forbidden" response after a retransmission.

                 * when retransmissions were sent when a matching peer did
                 not exist, but were not when a matching peer did exist.

    Resolution  This issue can only be mitigated by upgrading to versions of
                Asterisk that contain the patch or applying the patch.

                               Affected Versions
                Product                Release Series
          Asterisk Open Source              1.8.x        All Versions
          Asterisk Open Source              10.x         All Versions
          Asterisk Open Source              11.x         All Versions
           Certified Asterisk              1.8.15        All Versions
       Asterisk Business Edition            C.3.x        All Versions
         Asterisk Digiumphones        10.x-digiumphones  All Versions

                                  Corrected In
                  Product                              Release
           Asterisk Open Source               1.8.20.2, 10.12.2, 11.2.2
           Asterisk Digiumphones                10.12.2-digiumphones
            Certified Asterisk                      1.8.15-cert2
         Asterisk Business Edition                     C.3.8.1

                                     Patches
                                SVN URL
 Revision
http://downloads.asterisk.org/pub/security/AST-2013-003-1.8.diff
Asterisk
                                                                         1.8
http://downloads.asterisk.org/pub/security/AST-2013-003-10.diff
 Asterisk
                                                                         10
http://downloads.asterisk.org/pub/security/AST-2013-003-11.diff
 Asterisk
                                                                         11
http://downloads.asterisk.org/pub/security/AST-2013-003-1.8.15-cert.diffCertified

 Asterisk

 1.8.15
http://downloads.asterisk.org/pub/security/AST-2013-003-C.3.diff
Asterisk
                                                                         BE
C.3

       Links     https://issues.asterisk.org/jira/browse/ASTERISK-21013

    Asterisk Project Security Advisories are posted at
    http://www.asterisk.org/security

    This document may be superseded by later versions; if so, the latest
    version will be posted at
    http://downloads.digium.com/pub/security/AST-2013-003.pdf and
    http://downloads.digium.com/pub/security/AST-2013-003.html

                                Revision History
        Date          Editor                    Revisions Made
    2013-02-20    Kinsey Moore    Initial revision.
    2013-02-27    Kinsey Moore    Added Asterisk BE patch information.
    2013-02-27    Kinsey Moore    Corrected open source Asterisk versions.

               Asterisk Project Security Advisory - AST-2013-003
              Copyright (c) 2013 Digium, Inc. All Rights Reserved.
  Permission is hereby granted to distribute and publish this advisory in
its
                           original, unaltered form.


--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --

asterisk-dev mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-dev



-- 
Sylvio Jollenbeck
www.hosannatecnologia.com.br
-------------- Próxima Parte ----------
Um anexo em HTML foi limpo...
URL: http://listas.asteriskbrasil.org/pipermail/asteriskbrasil/attachments/20130327/7e185fcd/attachment-0001.htm