An issue exists in Asterisk Open Source 13.x prior to 13.21.1, 14.x prior to 14.7.7, and 15.x prior to 15.4.1 and Certified Asterisk 13.18-cert prior to 13.18-cert4 and 13.21-cert prior to 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However, if an endpoint is not identified, then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot be bypassed to gain access to the disclosed endpoints.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
digium asterisk |
||
digium certified asterisk 13.21 |
||
digium certified asterisk 13.18 |
||
debian debian linux 9.0 |
Vulmon