Asterisk is prone to an information-disclosure vulnerability because it doesn't provide safe responses to failed authentication attempts. Attackers can exploit this issue to discover whether specific usernames exist. Information harvested may aid in launching further attacks.

The vendor has released an advisory and updates. Please see the references for details.

• http://downloads.asterisk.org/pub/security/AST-2009-008.html
• http://www.asterisk.org/
• http://www.securityfocus.com/archive/1/507688
• http://www.securityfocus.com/bid/36924

---

Updated on 2015-03-25