CVE-2008-3903

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2008-3903
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2008-3903.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2008-3903
Related
Published
2008-09-04T19:41:00Z
Modified
2024-06-30T12:01:22Z
Summary
[none]
Details

Asterisk Open Source 1.2.x before 1.2.32, 1.4.x before 1.4.24.1, and 1.6.0.x before 1.6.0.8; Asterisk Business Edition A.x.x, B.x.x before B.2.5.8, C.1.x.x before C.1.10.5, and C.2.x.x before C.2.3.3; s800i 1.3.x before 1.3.0.2; and Trixbox PBX 2.6.1, when Digest authentication and authalwaysreject are enabled, generates different responses depending on whether a SIP username is valid, which allows remote attackers to enumerate valid usernames.

References

Affected packages

Debian:11 / asterisk

Package

Name
asterisk
Purl
pkg:deb/debian/asterisk?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.6.1.0~dfsg-1

Ecosystem specific

{
    "urgency": "low"
}