kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2026-07-21 19:37:13 -07:00
Code Issues Packages Projects Releases Wiki Activity

Fix a security issue where sending a REGISTER with a differing username in the From

Browse Source 
URI and Authorization header would reveal whether it was valid or not.

(AST-2009-008)


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.2@227698 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
Joshua Colp
2009-11-04 19:16:33 +00:00
parent 78130b6b77
commit fe80ce7e5d
1 changed files with 0 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
channels/chan_sip.c
-2
View File
@@ -6829,8 +6829,6 @@ static int register_verify(struct sip_pvt *p, struct sockaddr_in *sin, struct si
Asterisk uses the From: username for authentication. We need the
users to use the same authentication user name until we support
proper authentication by digest auth name */
transmit_response(p, "403 Authentication user name does not match account name", &p->initreq);
break;
case -3: /* Unknown domain */
case -4: /* ACL error */
case -5: /* Peer is not supposed to register with us at all */