]> git.ipfire.org Git - thirdparty/asterisk.git/commit
AST-2018-008: Fix enumeration of endpoints from ACL rejected addresses. certified/13.18
authorRichard Mudgett <rmudgett@digium.com>
Mon, 30 Apr 2018 22:38:58 +0000 (17:38 -0500)
committerRichard Mudgett <rmudgett@digium.com>
Mon, 11 Jun 2018 16:18:42 +0000 (10:18 -0600)
commit9fc59c223cc56c718b99b6cef2cb03dfcaf0a234
treef2b0c652d3fca8427fc697301ddc0f7701290f64
parent9b9e8bdb5a8b1b819897d8a1e3922efe309a8c88
AST-2018-008: Fix enumeration of endpoints from ACL rejected addresses.

When endpoint specific ACL rules block a SIP request they respond with a
403 forbidden.  However, if an endpoint is not identified then a 401
unauthorized response is sent.  This vulnerability just discloses which
requests hit a defined endpoint.  The ACL rules cannot be bypassed to gain
access to the disclosed endpoints.

* Made endpoint specific ACL rules now respond with a 401 unauthorized
which is the same as if an endpoint were not identified.  The fix is
accomplished by replacing the found endpoint with the artificial endpoint
which always fails authentication.

ASTERISK-27818

Change-Id: Icb275a54ff8e2df6c671a6d9bda37b5d732b3b32
res/res_pjsip/pjsip_distributor.c