CVE-2009-3727 Information disclosure in n/a

What is CVE-2009-3727?

CVE-2009-3727 is a medium-severity vulnerability in Digium Asterisk, published on 10 Nov 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, 1.6.0.x before 1.6.0.17, and 1.6.1.x before 1.6.1.9; Business Edition A.x.x, B.x.x before B.2.5.12, C.2.x.x before C.2.4.5, and C.3.x.x before C.3.2.2; AsteriskNOW 1.5; and s800i 1.3.x before 1.3.0.5 generate different error messages depending on whether a SIP username is valid, which allows remote attackers to enumerate valid usernames via multiple crafted REGISTER messages with inconsistent usernames in the URI in the To header and the Digest in the Authorization header.

Weakness: CWE-200

Which versions are affected by CVE-2009-3727?

It affects 3 products.

Products include Digium Asterisk, Digium Asterisknow, Digium S800i.

How do I fix CVE-2009-3727?

Upgrade to a fixed version.

Is CVE-2009-3727 being exploited?

There is no known exploitation of CVE-2009-3727 in the wild and no public exploit code.

Other vulnerabilities in Digium Asterisk

• CVE-2017-14100 Command injection in n/a Critical 9.8
• CVE-2014-8418 Privilege escalation in n/a Critical 9.0
• CVE-2011-1599 Missing authorization in n/a Critical 9.0
• CVE-2017-16671 Memory corruption in n/a High 8.8
• CVE-2017-7617 Memory corruption in n/a High 8.8

All Digium Asterisk vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2009-3727, GHSA-827c-j6w2-8fg4.