Unscored severity · published Nov 10, 2009
CVE-2009-3727
Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, 1.6.0.x before 1.6.0.17, and 1.6.1.x before 1.6.1.9; Business Edition A.x.x, B.x.x before B.2.5.12, C.2.x.x before…
–
CVSS
4.2%
EPSS
No
On KEV
Description
Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, 1.6.0.x before 1.6.0.17, and 1.6.1.x before 1.6.1.9; Business Edition A.x.x, B.x.x before B.2.5.12, C.2.x.x before C.2.4.5, and C.3.x.x before C.3.2.2; AsteriskNOW 1.5; and s800i 1.3.x before 1.3.0.5 generate different error messages depending on whether a SIP username is valid, which allows remote attackers to enumerate valid usernames via multiple crafted REGISTER messages with inconsistent usernames in the URI in the To header and the Digest in the Authorization header.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.2% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Asterisk · Digium
1.2.0; 1.2.0; 1.2.0; 1.2.0; 1.2.0; 1.2.1; +34 more · source: NVD
AS
Asterisknow · Digium
1.5 · source: NVD
S8
S800i · Digium
1.3.0; 1.3.0.2; 1.3.0.3; 1.3.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3727
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3727
Vendor Advisory
http://downloads.asterisk.org/pub/security/AST-2009-008.html
osvdb.org
http://osvdb.org/59697
Vendor Advisory
http://secunia.com/advisories/37265
secunia.com
http://secunia.com/advisories/37479
secunia.com
http://secunia.com/advisories/37677
www.debian.org
http://www.debian.org/security/2009/dsa-1952
More from Asterisk
9.8
CVE-2022-26651
An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13
9.8
CVE-2017-14100
In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized command…
9.1
CVE-2022-26499
An SSRF issue was discovered in Asterisk through 19.x
8.8
CVE-2019-18610
An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4
8.8
CVE-2017-16671
A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7