NVD

Id
50910  
Name
CVE-2009-3727  
Description
Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, 1.6.0.x before 1.6.0.17, and 1.6.1.x before 1.6.1.9; Business Edition A.x.x, B.x.x before B.2.5.12, C.2.x.x before C.2.4.5, and C.3.x.x before C.3.2.2; AsteriskNOW 1.5; and s800i 1.3.x before 1.3.0.5 generate different error messages depending on whether a SIP username is valid, which allows remote attackers to enumerate valid usernames via multiple crafted REGISTER messages with inconsistent usernames in the URI in the To header and the Digest in the Authorization header.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-07  
Published
2009-11-10  
Modified Date
2009-12-23  
Seq
2009-3727  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
257808 50910 CVE-2009-3727 http://downloads.asterisk.org/pub/security/AST-2009-008.html  View
257809 50910 CVE-2009-3727 DSA-1952  View
257810 50910 CVE-2009-3727 36924  View
257811 50910 CVE-2009-3727 1023133  View
257812 50910 CVE-2009-3727 https://bugzilla.redhat.com/show_bug.cgi?id=523277  View
257813 50910 CVE-2009-3727 https://bugzilla.redhat.com/show_bug.cgi?id=533137  View
257814 50910 CVE-2009-3727 FEDORA-2009-11070  View
257815 50910 CVE-2009-3727 FEDORA-2009-11126  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
42851 JVNDB-2009-003858 Asterisk Open Source における有効なユーザ名を列挙される脆弱性 Asterisk Open Source、AsteriskNOW および s800i には、SIP ユーザ名が有効かどうかに依存する異なるエラーメッセージを生成するため、有効なユーザ名を列挙される脆弱性が存在します。 CVE-2009-3727 41158 CVE-2009-3727 50910 5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-003858.html 2009-10-26 2012-06-26 View