CVE-2011-4597

The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series of requests.

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

3.16% chance of exploitation in the next 30 days, 88th percentile

Published

2011-12-15

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://archives.neohapsis.com/archives/bugtraq/2011-12/0151.html

References

• CVE Record
• NVD entry