CVE-2009-0041

IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and C.2.x.x before C.2.1.2.1; and s800i 1.2.x before 1.3.0 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 70%
VendorProductVersion
asteriskopen_source
𝑥
≤ 1.2.30.4
asteriskopen_source
𝑥
≤ 1.4.23
asteriskopen_source
𝑥
≤ 1.6.0.3
asteriskopen_source
1.2.0
asteriskopen_source
1.2.0:beta1
asteriskopen_source
1.2.0:beta2
asteriskopen_source
1.2.0:rc1
asteriskopen_source
1.2.0:rc2
asteriskopen_source
1.2.0beta1:beta1
asteriskopen_source
1.2.0beta2:beta2
asteriskopen_source
1.2.1
asteriskopen_source
1.2.2
asteriskopen_source
1.2.2:netsec
asteriskopen_source
1.2.3
asteriskopen_source
1.2.3:netsec
asteriskopen_source
1.2.10
asteriskopen_source
1.2.10:netsec
asteriskopen_source
1.2.11
asteriskopen_source
1.2.11:netsec
asteriskopen_source
1.2.12
asteriskopen_source
1.2.12:netsec
asteriskopen_source
1.2.12.1
asteriskopen_source
1.2.12.1:netsec
asteriskopen_source
1.2.13
asteriskopen_source
1.2.13:netsec
asteriskopen_source
1.2.14
asteriskopen_source
1.2.14:netsec
asteriskopen_source
1.2.15
asteriskopen_source
1.2.15:netsec
asteriskopen_source
1.2.16
asteriskopen_source
1.2.16:netsec
asteriskopen_source
1.2.17
asteriskopen_source
1.2.17:netsec
asteriskopen_source
1.2.18
asteriskopen_source
1.2.18:netsec
asteriskopen_source
1.2.19
asteriskopen_source
1.2.19:netsec
asteriskopen_source
1.2.20
asteriskopen_source
1.2.20:netsec
asteriskopen_source
1.2.21
asteriskopen_source
1.2.21:netsec
asteriskopen_source
1.2.21.1
asteriskopen_source
1.2.21.1:netsec
asteriskopen_source
1.2.22
asteriskopen_source
1.2.22:netsec
asteriskopen_source
1.2.23
asteriskopen_source
1.2.23:netsec
asteriskopen_source
1.2.24
asteriskopen_source
1.2.24:netsec
asteriskopen_source
1.2.25
asteriskopen_source
1.2.25:netsec
asteriskopen_source
1.2.26
asteriskopen_source
1.2.26:netsec
asteriskopen_source
1.2.26.1
asteriskopen_source
1.2.26.1:netsec
asteriskopen_source
1.2.26.2
asteriskopen_source
1.2.26.2:netsec
asteriskopen_source
1.2.27
asteriskopen_source
1.2.28
asteriskopen_source
1.2.29
asteriskopen_source
1.2.30
asteriskopen_source
1.2.30.2
asteriskopen_source
1.2.30.3
asteriskopen_source
1.4.0
asteriskopen_source
1.4.0:beta2
asteriskopen_source
1.4.0:beta3
asteriskopen_source
1.4.0:beta4
asteriskopen_source
1.4.1
asteriskopen_source
1.4.2
asteriskopen_source
1.4.3
asteriskopen_source
1.4.4
asteriskopen_source
1.4.5
asteriskopen_source
1.4.6
asteriskopen_source
1.4.7
asteriskopen_source
1.4.7.1
asteriskopen_source
1.4.8
asteriskopen_source
1.4.9
asteriskopen_source
1.4.10
asteriskopen_source
1.4.10.1
asteriskopen_source
1.4.11
asteriskopen_source
1.4.12
asteriskopen_source
1.4.12.1
asteriskopen_source
1.4.13
asteriskopen_source
1.4.14
asteriskopen_source
1.4.15
asteriskopen_source
1.4.16
asteriskopen_source
1.4.16.1
asteriskopen_source
1.4.16.2
asteriskopen_source
1.4.17
asteriskopen_source
1.4.18
asteriskopen_source
1.4.18.1
asteriskopen_source
1.4.19
asteriskopen_source
1.4.19:rc1
asteriskopen_source
1.4.19:rc2
asteriskopen_source
1.4.19:rc3
asteriskopen_source
1.4.19:rc4
asteriskopen_source
1.4.19.1
asteriskopen_source
1.4.19.2
asteriskopen_source
1.4.20
asteriskopen_source
1.4.20:rc1
asteriskopen_source
1.4.20:rc2
asteriskopen_source
1.4.20:rc3
asteriskopen_source
1.4.21
asteriskopen_source
1.4.21:rc1
asteriskopen_source
1.4.21:rc2
asteriskopen_source
1.4.21.1
asteriskopen_source
1.4.21.2
asteriskopen_source
1.4.22
asteriskopen_source
1.4.22:rc3
asteriskopen_source
1.4.22:rc4
asteriskopen_source
1.4.22.1
asteriskopen_source
1.4.22.2
asteriskopen_source
1.4.23
asteriskopen_source
1.4.23:rc1
asteriskopen_source
1.4.23:rc2
asteriskopen_source
1.4_revision_95946:_revision_95946
asteriskopen_source
1.4beta:beta
asteriskopen_source
1.6.0:beta1
asteriskopen_source
1.6.0:beta2
asteriskopen_source
1.6.0:beta3
asteriskopen_source
1.6.0:beta4
asteriskopen_source
1.6.0:beta5
asteriskopen_source
1.6.0:beta7
asteriskopen_source
1.6.0:beta7.1
asteriskopen_source
1.6.0:beta8
asteriskopen_source
1.6.0:beta9
asteriskopen_source
1.6.0:rc4
asteriskopen_source
1.6.0:rc5
asteriskopen_source
1.6.0:rc6
asteriskopen_source
1.6.0.1
asteriskopen_source
1.6.0.2
asteriskopen_source
1.6.0.3
asterisks800i_appliance
1.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
asterisk
bullseye
1:16.28.0~dfsg-0+deb11u4
fixed
lenny
no-dsa
bullseye (security)
1:16.28.0~dfsg-0+deb11u5
fixed
sid
1:22.0.0~dfsg+~cs6.14.60671435-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
asterisk
maverick
not-affected
lucid
not-affected
karmic
not-affected
jaunty
ignored
intrepid
ignored
hardy
Fixed 1:1.4.17~dfsg-2ubuntu1.1
released
gutsy
ignored
dapper
ignored