Description
The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series of requests.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asterisk | 1:1.8.8.0~dfsg-1 | — |
| Debian 6.0 | asterisk | 1:1.6.2.9-2+squeeze4 | DSA-2367-1 |
| Debian 5.0 | asterisk | 1:1.4.21.2~dfsg-3+lenny6 | DSA-2367-1 |
Advisories 1
- DSA-2367-1 asterisk - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 77597 vdb-entry
- http://downloads.asterisk.org/pub/security/AST-2011-013.html
- [oss-security] 20111209 Re: CVE Request -- Asterisk -- AST-2011-013 and AST-2011-014 mailing-list
- [oss-security] 20111209 CVE Request -- Asterisk -- AST-2011-013 and AST-2011-014 mailing-list
- 47273 third-party-advisory
- 20111222 Exploit for Asterisk Security Advisory AST-2011-013 mailing-list
- DSA-2367 vendor-advisory
- [asterisk-dev] 20111108 Summary: SIP, NAT, security concerns, oh my! mailing-list