cvelist/2011/4xxx/CVE-2011-4597.json

{
    "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2011-4597",
        "STATE": "PUBLIC"
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "product": {
                        "product_data": [
                            {
                                "product_name": "n/a",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_value": "n/a"
                                        }
                                    ]
                                }
                            }
                        ]
                    },
                    "vendor_name": "n/a"
                }
            ]
        }
    },
    "data_format": "MITRE",
    "data_type": "CVE",
    "data_version": "4.0",
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series of requests."
            }
        ]
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "n/a"
                    }
                ]
            }
        ]
    },
    "references": {
        "reference_data": [
            {
                "name": "77597",
                "refsource": "OSVDB",
                "url": "http://osvdb.org/77597"
            },
            {
                "name": "http://downloads.asterisk.org/pub/security/AST-2011-013.html",
                "refsource": "CONFIRM",
                "url": "http://downloads.asterisk.org/pub/security/AST-2011-013.html"
            },
            {
                "name": "[oss-security] 20111209 Re: CVE Request -- Asterisk -- AST-2011-013 and AST-2011-014",
                "refsource": "MLIST",
                "url": "http://openwall.com/lists/oss-security/2011/12/09/4"
            },
            {
                "name": "[oss-security] 20111209 CVE Request -- Asterisk -- AST-2011-013 and AST-2011-014",
                "refsource": "MLIST",
                "url": "http://openwall.com/lists/oss-security/2011/12/09/3"
            },
            {
                "name": "47273",
                "refsource": "SECUNIA",
                "url": "http://secunia.com/advisories/47273"
            },
            {
                "name": "20111222 Exploit for Asterisk Security Advisory AST-2011-013",
                "refsource": "BUGTRAQ",
                "url": "http://archives.neohapsis.com/archives/bugtraq/2011-12/0151.html"
            },
            {
                "name": "DSA-2367",
                "refsource": "DEBIAN",
                "url": "http://www.debian.org/security/2011/dsa-2367"
            },
            {
                "name": "[asterisk-dev] 20111108 Summary: SIP, NAT, security concerns, oh my!",
                "refsource": "MLIST",
                "url": "http://lists.digium.com/pipermail/asterisk-dev/2011-November/052191.html"
            }
        ]
    }
}