SIP Username Enumeration

This script is Copyright (C) 2011-2017 Tenable Network Security, Inc.


Synopsis :

The SIP server on the remote host allows the enumeration of users.

Description :

The SIP server on the remote host appears to respond differently to
registration requests for valid and invalid usernames. Using that
fact, Nessus was able to enumerate some of the valid usernames.

See also :

https://tools.ietf.org/html/rfc3261

Solution :

Configure the SIP server to respond identically to valid and invalid
usernames. This can be done in Asterisk, for example, by setting
'alwaysauthreject=yes' in sip.conf.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)

Family: Misc.

Nessus Plugin ID: 56983 ()

Bugtraq ID:

CVE ID:

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now