Description
IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and C.2.x.x before C.2.1.2.1; and s800i 1.2.x before 1.3.0 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asterisk | 1:1.6.1.0~dfsg~rc3-1 | — |
| Debian 5.0 | asterisk | 1:1.4.21.2~dfsg-3+lenny1 | DSA-1952-1 |
Advisories 1
- DSA-1952-1 asterisk - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200905-01 vendor-advisory
- 20090108 AST-2009-001: Information leak in IAX2 authentication mailing-list
- 33453 third-party-advisory
- 4910 third-party-advisory
- 33174 vdb-entry
- 37677 third-party-advisory
- DSA-1952 vendor-advisory
- 1021549 vdb-entry
- http://downloads.digium.com/pub/security/AST-2009-001.html
- ADV-2009-0063 vdb-entry
- 34982 third-party-advisory