CVE-2008-3903

EUVD-2008-3889

04.09.2008, 19:41

Asterisk Open Source 1.2.x before 1.2.32, 1.4.x before 1.4.24.1, and 1.6.0.x before 1.6.0.8; Asterisk Business Edition A.x.x, B.x.x before B.2.5.8, C.1.x.x before C.1.10.5, and C.2.x.x before C.2.3.3; s800i 1.3.x before 1.3.0.2; and Trixbox PBX 2.6.1, when Digest authentication and authalwaysreject are enabled, generates different responses depending on whether a SIP username is valid, which allows remote attackers to enumerate valid usernames.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	3.5 UNKNOWN	NETWORK	MEDIUM		AV:N/AC:M/Au:S/C:P/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 74%

Affected Products (NVD)

Vendor	Product	Version
asterisk	p_b_x	1.2
asterisk	p_b_x	1.2.22
asterisk	p_b_x	1.4.21.1
asterisk	p_b_x	1.6
trixbox	pbx	2.6.1

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

asterisk

bullseye	1:16.28.0~dfsg-0+deb11u4 fixed
bullseye (security)	1:16.28.0~dfsg-0+deb11u5 fixed
lenny	no-dsa
sid	1:22.0.0~dfsg+~cs6.14.60671435-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

asterisk

dapper	ignored
feisty	ignored
gutsy	ignored
hardy	Fixed 1:1.4.17~dfsg-2ubuntu1.1 released
intrepid	ignored
jaunty	ignored
karmic	not-affected
lucid	not-affected
maverick	not-affected