Asterisk Project Security Advisory - AST-2009-003 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | SIP responses expose valid usernames | |--------------------+---------------------------------------------------| | Nature of Advisory | Information leak | |--------------------+---------------------------------------------------| | Susceptibility | Remote Unauthenticated Sessions | |--------------------+---------------------------------------------------| | Severity | Minor | |--------------------+---------------------------------------------------| | Exploits Known | No | |--------------------+---------------------------------------------------| | Reported On | February 23, 2009 | |--------------------+---------------------------------------------------| | Reported By | Gentoo Linux Project: Kerin Millar ( kerframil on | | | irc.freenode.net ) and Fergal Glynn < FGlynn AT | | | veracode DOT com > | |--------------------+---------------------------------------------------| | Posted On | April 2, 2009 | |--------------------+---------------------------------------------------| | Last Updated On | April 2, 2009 | |--------------------+---------------------------------------------------| | Advisory Contact | Tilghman Lesher < tlesher AT digium DOT com > | |--------------------+---------------------------------------------------| | CVE Name | CVE-2008-3903 | +------------------------------------------------------------------------+ +------------------------------------------------------------------------+ | Description | In 2006, the Asterisk maintainers made it more difficult | | | to scan for valid SIP usernames by implementing an | | | option called "alwaysauthreject", which should return a | | | 401 error on all replies which are generated for users | | | which do not exist. While this was sufficient at the | | | time, due to ever increasing compliance with RFC 3261, | | | the SIP specification, that is no longer sufficient as a | | | means towards preventing attackers from checking | | | responses to verify whether a SIP account exists on a | | | machine. | | | | | | What we have done is to carefully emulate exactly the | | | same responses throughout possible dialogs, which should | | | prevent attackers from gleaning this information. All | | | invalid users, if this option is turned on, will receive | | | the same response throughout the dialog, as if a | | | username was valid, but the password was incorrect. | | | | | | It is important to note several things. First, this | | | vulnerability is derived directly from the SIP | | | specification, and it is a technical violation of RFC | | | 3261 (and subsequent RFCs, as of this date), for us to | | | return these responses. Second, this attack is made much | | | more difficult if administrators avoided creating | | | all-numeric usernames and especially all-numeric | | | passwords. This combination is extremely vulnerable for | | | servers connected to the public Internet, even with this | | | patch in place. While it may make configuring SIP | | | telephones easier in the short term, it has the | | | potential to cause grief over the long term. | +------------------------------------------------------------------------+ +------------------------------------------------------------------------+ | Resolution | Upgrade to one of the versions below, or apply one of the | | | patches specified in the Patches section. | +------------------------------------------------------------------------+ +------------------------------------------------------------------------+ | Affected Versions | |------------------------------------------------------------------------| | Product | Release | | | | Series | | |----------------------------+------------+------------------------------| | Asterisk Open Source | 1.2.x | All versions prior to 1.2.32 | |----------------------------+------------+------------------------------| | Asterisk Open Source | 1.4.x | All versions prior to | | | | 1.4.24.1 | |----------------------------+------------+------------------------------| | Asterisk Open Source | 1.6.0.x | All versions prior to | | | | 1.6.0.8 | |----------------------------+------------+------------------------------| | Asterisk Addons | 1.2.x | Not affected | |----------------------------+------------+------------------------------| | Asterisk Addons | 1.4.x | Not affected | |----------------------------+------------+------------------------------| | Asterisk Addons | 1.6.x | Not affected | |----------------------------+------------+------------------------------| | Asterisk Business Edition | A.x.x | All versions | |----------------------------+------------+------------------------------| | Asterisk Business Edition | B.x.x | All versions prior to | | | | B.2.5.8 | |----------------------------+------------+------------------------------| | Asterisk Business Edition | C.1.x.x | All versions prior to | | | | C.1.10.5 | |----------------------------+------------+------------------------------| | Asterisk Business Edition | C.2.x.x | All versions prior to | | | | C.2.3.3 | |----------------------------+------------+------------------------------| | AsteriskNOW | 1.5 | Not affected | |----------------------------+------------+------------------------------| | s800i (Asterisk Appliance) | 1.3.x | All versions prior to | | | | 1.3.0.2 | +------------------------------------------------------------------------+ +------------------------------------------------------------------------+ | Corrected In | |------------------------------------------------------------------------| | Product | Release | |---------------------------------------------+--------------------------| | Asterisk Open Source | 1.2.32 | |---------------------------------------------+--------------------------| | Asterisk Open Source | 1.4.24.1 | |---------------------------------------------+--------------------------| | Asterisk Open Source | 1.6.0.8 | |---------------------------------------------+--------------------------| | Asterisk Business Edition | B.2.5.8 | |---------------------------------------------+--------------------------| | Asterisk Business Edition | C.1.10.5 | |---------------------------------------------+--------------------------| | Asterisk Business Edition | C.2.3.3 | |---------------------------------------------+--------------------------| | s800i (Asterisk Appliance) | 1.3.0.2 | +------------------------------------------------------------------------+ +------------------------------------------------------------------------+ | Patches | |------------------------------------------------------------------------| | Patch URL |Version| |----------------------------------------------------------------+-------| |http://downloads.digium.com/pub/asa/AST-2009-003-1.2.diff.txt | 1.2 | |----------------------------------------------------------------+-------| |http://downloads.digium.com/pub/asa/AST-2009-003-1.4.diff.txt | 1.4 | |----------------------------------------------------------------+-------| |http://downloads.digium.com/pub/asa/AST-2009-003-1.6.0.diff.txt | 1.6.0 | |----------------------------------------------------------------+-------| |http://downloads.digium.com/pub/asa/AST-2009-003-1.6.1.diff.txt | 1.6.1 | +------------------------------------------------------------------------+ +------------------------------------------------------------------------+ | Links | http://www.faqs.org/rfcs/rfc3261.html | +------------------------------------------------------------------------+ +------------------------------------------------------------------------+ | Asterisk Project Security Advisories are posted at | | http://www.asterisk.org/security | | | | This document may be superseded by later versions; if so, the latest | | version will be posted at | | http://downloads.digium.com/pub/security/AST-2009-003.pdf and | | http://downloads.digium.com/pub/security/AST-2009-003.html | +------------------------------------------------------------------------+ +------------------------------------------------------------------------+ | Revision History | |------------------------------------------------------------------------| | Date | Editor | Revisions Made | |-----------------+------------------------+-----------------------------| | 2009-04-02 | Tilghman Lesher | Initial release | +------------------------------------------------------------------------+ Asterisk Project Security Advisory - AST-2009-003 Copyright (c) 2009 Digium, Inc. All Rights Reserved. Permission is hereby granted to distribute and publish this advisory in its original, unaltered form.
