An issue in Asterisk allows disclosure of which requests hit a defined endpoint when endpoint-specific ACL rules block a SIP request. Normally, blocked requests respond with a 403 forbidden. However, if an endpoint is not identified, a 401 unauthorized response is sent instead. This does not allow ACL rules to be bypassed to gain access to the disclosed endpoints.