CVE-2011-2666 | BDVDB-2026-46586 Detail

Description#

The default configuration of the SIP channel driver in Asterisk Open Source 1.4.x through 1.4.41.2 and 1.6.2.x through 1.6.2.18.2 does not enable the alwaysauthreject option, which allows remote attackers to enumerate account names by making a series of invalid SIP requests and observing the differences in the responses for different usernames, a different vulnerability than CVE-2011-2536.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://exchange.xforce.ibmcloud.com/vulnerabilities/68472
http://downloads.asterisk.org/pub/security/AST-2011-011.html

Exploit#

No public exploit known

History#

Version 12011-07-06Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.