CVEvulnerability

CVE-2009-0041

5.0 MEDIUM Published 2009-01-14 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-01-14
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and C.2.x.x before C.2.1.2.1; and s800i 1.2.x before 1.3.0 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.

Affected configurations

• asterisk asterisk business edition (<= b.2.5.2) • asterisk asterisk business edition (<= c.1.0) • asterisk asterisk business edition a • asterisk asterisk business edition b.1.3.2 • asterisk asterisk business edition b.1.3.3 • asterisk asterisk business edition b.2.2.0 • asterisk asterisk business edition b.2.2.1 • asterisk asterisk business edition b.2.3.1 • asterisk asterisk business edition b.2.3.2 • asterisk asterisk business edition b.2.3.3 • asterisk asterisk business edition b.2.3.4 • asterisk asterisk business edition b.2.3.5 • asterisk asterisk business edition b.2.3.6 • asterisk asterisk business edition b.2.5.0 • asterisk asterisk business edition b.2.5.1 • asterisk asterisk business edition b.2.5.3 • asterisk asterisk business edition c.1.0 • asterisk open source (<= 1.2.30.4) • asterisk open source (<= 1.4.23) • asterisk open source (<= 1.6.0.3) • asterisk open source 1.2.0 • asterisk open source 1.2.0beta1 • asterisk open source 1.2.0beta2 • asterisk open source 1.2.1 • asterisk open source 1.2.2 • asterisk open source 1.2.3 • asterisk open source 1.2.10 • asterisk open source 1.2.11 • asterisk open source 1.2.12 • asterisk open source 1.2.12.1 • asterisk open source 1.2.13 • asterisk open source 1.2.14 • asterisk open source 1.2.15 • asterisk open source 1.2.16 • asterisk open source 1.2.17 • asterisk open source 1.2.18 • asterisk open source 1.2.19 • asterisk open source 1.2.20 • asterisk open source 1.2.21 • asterisk open source 1.2.21.1 • asterisk open source 1.2.22 • asterisk open source 1.2.23 • asterisk open source 1.2.24 • asterisk open source 1.2.25 • asterisk open source 1.2.26 • asterisk open source 1.2.26.1 • asterisk open source 1.2.26.2 • asterisk open source 1.2.27 • asterisk open source 1.2.28 • asterisk open source 1.2.29 • asterisk open source 1.2.30 • asterisk open source 1.2.30.2 • asterisk open source 1.2.30.3 • asterisk open source 1.4.0 • asterisk open source 1.4.1 • asterisk open source 1.4.2 • asterisk open source 1.4.3 • asterisk open source 1.4.4 • asterisk open source 1.4.5 • asterisk open source 1.4.6 … and 36 more

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References