SIP Username Enumeration

This script is Copyright (C) 2011-2014 Tenable Network Security, Inc.


Synopsis :

The SIP server on the remote host allows the enumeration of users.

Description :

The SIP server on the remote host appears to respond differently to
registration requests for valid and invalid usernames. Using that
fact, Nessus was able to enumerate some of the valid usernames.

See also :

http://tools.ietf.org/html/rfc3261

Solution :

Configure the SIP server to respond identically to valid and invalid
usernames. This can be done in Asterisk, for example, by setting
'alwaysauthreject=yes' in sip.conf.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)

Family: Misc.

Nessus Plugin ID: 56983 ()

Bugtraq ID:

CVE ID: