You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Matthew Jordan 9c2c562425 AST-2013-003: Prevent username disclosure in SIP channel driver ... When authenticating a SIP request with alwaysauthreject enabled, allowguest disabled, and autocreatepeer disabled, Asterisk discloses whether a user exists for INVITE, SUBSCRIBE, and REGISTER transactions in multiple ways. The information is disclosed when: * A "407 Proxy Authentication Required" response is sent instead of a "401 Unauthorized" response * The presence or absence of additional tags occurs at the end of "403 Forbidden" (such as "(Bad Auth)") * A "401 Unauthorized" response is sent instead of "403 Forbidden" response after a retransmission * Retransmission are sent when a matching peer did not exist, but not when a matching peer did exist. This patch resolves these various vectors by ensuring that the responses sent in all scenarios is the same, regardless of the presence of a matching peer. This issue was reported by Walter Doekes, OSSO B.V. A substantial portion of the testing and the solution to this problem was done by Walter as well - a huge thanks to his tireless efforts in finding all the ways in which this setting didn't work, providing automated tests, and working with Kinsey on getting this fixed. (closes issue ASTERISK-21013) Reported by: wdoekes Tested by: wdoekes, kmoore patches: AST-2013-003-1.8 uploaded by kmoore, wdoekes (License 6273, 5674) AST-2013-003-10 uploaded by kmoore, wdoekes (License 6273, 5674) AST-2013-003-11 uploaded by kmoore, wdoekes (License 6273, 5674) git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/10@383982 65c4cc65-6c06-0410-ace0-fbb531ad65f3		12 years ago
..
include	AST-2013-003: Prevent username disclosure in SIP channel driver	12 years ago
config_parser.c	Multiple revisions 370769-370771	13 years ago
dialplan_functions.c	Multiple revisions 369001-369002	13 years ago
reqresp_parser.c	Multiple revisions 369001-369002	13 years ago
sdp_crypto.c	Only re-create an SRTP session when needed	13 years ago
security_events.c	AST-2013-003: Prevent username disclosure in SIP channel driver	12 years ago
srtp.c	Multiple revisions 369001-369002	13 years ago